Port 3036: Hagel DUMP — A Ghost in the Registry

What Port 3036 Is

Port 3036 sits in the registered port range (1024–49151). IANA's official registry lists it as assigned to hagel-dump — a proprietary protocol belonging to Hagel Technologies, the company behind DU Meter, a Windows network bandwidth monitoring tool that has existed since 1997.

The service name tells you most of what you need to know: it was a "dump" endpoint for DU Meter, likely used to report or export bandwidth usage data. The exact protocol details were never publicly documented, and DU Meter has faded to near-total obscurity. Most port reference databases still list port 3036 as unassigned or unknown — because functionally, it is.

The Registered Port Range

Registered ports (1024–49151) are ports that IANA tracks in its Service Name and Transport Protocol Port Number Registry. Anyone can apply to register a port for their application. Registration does not require open standards, peer review, or public documentation. It just requires submitting a request.

The result: thousands of ports in this range are registered to obscure, long-dead, or proprietary services. Port 3036 is one of them. Registered on paper. Empty in practice.

What You Will Actually Find on Port 3036

If you find something listening on port 3036 on one of your machines, it is not DU Meter's hagel-dump protocol. It is almost certainly one of these:

• A development server that happened to land on this port
• An application that picked a high-numbered port arbitrarily
• Something worth investigating

How to Check What Is Listening

On Linux or macOS:

# Show what process is using port 3036
ss -tlnp | grep 3036

# Or with lsof
lsof -i :3036

On Windows:

netstat -ano | findstr :3036

The output will show you the process ID. From there, you can look up the process name in Task Manager or with tasklist | findstr <PID>.

Why Ghost Ports Matter

The registered port range has over 48,000 slots. A meaningful fraction of them are like port 3036 — claimed by software that no longer ships, companies that no longer exist, or protocols that were never publicly implemented.

This creates two real problems. First, new software sometimes collides with these ghost registrations, causing hard-to-diagnose conflicts. Second, security scanners and firewall rules that treat "IANA registered" as "known safe" can be fooled by the distinction between registered and documented.

An open port 3036 tells you almost nothing. The port number itself carries no signal. Look at what is actually running.