Port 3394: The Gap Between Assignment and Reality

What Range This Port Belongs To

Port 3394 is a registered port — part of the range from 1024 to 49151 that IANA manages for services requesting a stable, named assignment. Unlike the well-known ports (0–1023), which require IANA approval and carry protocols the entire Internet depends on, registered ports are more loosely governed. A company or project files a request, IANA records it, and the port gets a name in the registry.¹

The name on record for port 3394 is d2k-tapestry2 — "D2K Tapestry Server to Server." This was server-to-server communication software from the early 2000s. The product is effectively gone. The assignment remains, frozen in the registry like a company name on a door that no longer opens.

This is common. The registered range contains thousands of ports assigned to software that hasn't shipped a new version in fifteen years.

What Actually Shows Up Here

The most documented real-world presence on port 3394 is u2ec — USB-over-Ethernet client — running on ASUS routers.²

u2ec is the service behind ASUS's "AiDisk" and USB sharing features. When you plug a USB printer or storage drive into your router, u2ec makes it available to devices across your local network. It listens on port 3394 (alongside 5473) on your internal interface.

This is not a security concern on its own. The service is designed for LAN use and should not be reachable from the Internet. If you see port 3394 appearing open in a WAN scan of your router, double-check that you're actually scanning from outside your network — in documented cases, users scanning from their LAN mistakenly thought they were scanning their public IP.²

Is It Safe?

An open port 3394 means something is listening. Whether that's fine depends entirely on what the something is:

• ASUS router, LAN-side: u2ec doing its job. Normal.
• A server you manage: Check what process opened it. The D2K Tapestry software is unlikely; something else claimed the port.
• Unknown system: Worth investigating.

The port itself is not inherently dangerous. The SANS Internet Storm Center tracks scanning activity on most ports; 3394 generates no notable alarm.³

How to Check What's Listening

On Linux or macOS:

sudo ss -tlnp | grep 3394
# or
sudo lsof -i :3394

On Windows:

netstat -ano | findstr :3394

The output will show the process ID. Match it to a process name with Task Manager (Windows) or ps (Linux/macOS).

To scan from another machine:

nmap -sV -p 3394 <target-ip>

The -sV flag asks Nmap to probe the service and identify what's actually running, not just whether the port is open.

Why Unassigned Ports Matter

The registered range exists to give software stable, predictable home addresses — so that firewall rules, documentation, and network diagrams can refer to a port by name rather than just number. When assignments go stale, the system degrades a little: port 3394 is "assigned" to software that doesn't run anywhere, while u2ec uses it without any formal registration.

This is not a crisis. It's just how the port namespace ages. Assignments don't expire. Products do.