Port 3012: twsdss — A Name Nobody Uses

What This Port Is

Port 3012 sits in the registered port range (1024–49151). These ports are formally catalogued by IANA, meaning any software author can request a port number for their service and receive an official assignment. The catch: registration doesn't require adoption. You can register a port, never ship the software, and the entry sits in the registry forever.

Port 3012 is registered to twsdss, described as "Trusted Web Client." No RFC defines it. No major software ships it. The registration exists; the service does not, at least not in any publicly observable way. ¹

What Actually Ran Here

The port's real history belongs to Vaultwarden, the community-built, self-hostable alternative to Bitwarden's official server.

Vaultwarden needed WebSocket support to push real-time notifications to connected clients: vault modified, item deleted, sync needed. Rather than fold WebSockets into its main HTTP port, the original implementation bound a separate WebSocket listener on port 3012. For years, every Vaultwarden deployment had to expose this port and thread it through whatever reverse proxy stood in front.

Starting with v1.29.0, Vaultwarden merged WebSocket handling into the main HTTP port using Rocket's built-in WebSocket support. Port 3012 became optional. By v1.31.0, the separate implementation was removed entirely. ²

Port 3012's most active chapter is now closed.

Other Observed Uses

• Citrix App Layering uses port 3012 for HTTP-based Hyper-V disk downloads in enterprise virtualization environments. ³
• Various port scanners flag it with historical malware associations, as any open, unguarded port will eventually attract probes.

What's Listening on Your Machine?

If you see activity on port 3012 and want to know what's using it:

Linux / macOS:

# Show process using port 3012
sudo lsof -i :3012

# Alternative with ss
sudo ss -tlnp | grep 3012

Windows:

netstat -ano | findstr :3012

Take the PID from the output and look it up in Task Manager or with tasklist /fi "pid eq <PID>".

Why Unassigned-in-Practice Ports Matter

The registered port range has over 48,000 slots. IANA has assigned a fraction of them, and of those assignments, many are like port 3012's "twsdss" — names without software, registrations without deployments.

This gap is why you can't assume a port number tells you what's running. The registry is a starting point, not a ground truth. What's actually on a port is determined by whatever process opened it — and that process may have nothing to do with IANA's records.

When you're auditing a system, tool output wins over registry lookups every time.