Port 3198: Embrace Device Protocol Client — A Forgotten Assignment at the Edge of a Worm

Port 3198 sits in the registered port range (1024-49151), where IANA tracks assignments for specific services. On paper, it belongs to Embrace Device Protocol Client (service name: embrace-dp-c), registered by Elliot Schwartz at MIT for both TCP and UDP.¹

In practice, Embrace Device Protocol is effectively unknown. No widely-used software implements it. No documentation describes what it does. The assignment exists, the name persists in port databases, and that's about the extent of it.

The MyDoom Connection

Port 3198's more interesting history comes from 2004. MyDoom — still the fastest-spreading email worm ever recorded — contained a backdoor component that would scan for an available TCP port starting at 3127 and working upward to 3198.²

Whatever port MyDoom found open first, it claimed. Connecting to that port gave an attacker remote proxy access to the infected machine, plus the ability to upload and execute arbitrary files. Port 3198 was the top of that range — the last door the worm would try before giving up.

This is why security tools still flag open ports anywhere in the 3127-3198 range. The worm is long dead, but the range lives on as a detection heuristic.

What Range This Belongs To

Registered ports (1024-49151) require IANA assignment. They're used by applications, servers, and protocols that aren't system services but still want a predictable, documented location. Unlike well-known ports (0-1023), registered ports don't require root or administrator privileges to bind on most systems, which is part of why malware found them attractive.

How to Check What's Listening

To see if anything is using port 3198 on your machine:

macOS / Linux:

lsof -i :3198

Windows:

netstat -ano | findstr :3198

If something is listening and you don't recognize it, check the process ID against your running processes. On a modern, uninfected machine, you should see nothing.