Port 3727: e-mdu — Ericsson's Ghost Protocol

What This Port Is

Port 3727 sits in the registered port range (1024–49151). These ports require formal IANA registration, which means some organization filed a claim, said "we're using this," and got it stamped into the registry.

Port 3727 has exactly that: a registration. IANA lists it as e-mdu, short for Ericsson Mobile Data Unit, registered in April 2003 for both TCP and UDP.¹

And that's roughly where the trail ends.

The Ghost in the Registry

There is no RFC. There is no public technical specification. There is no observable deployment. A search across security databases, network scanner logs, and protocol documentation turns up essentially nothing about what e-mdu actually does or how it works.

This isn't unusual for early-2000s telecom vendor registrations. Ericsson, like many large infrastructure companies, registered ports for internal or proprietary protocols — protocols designed for communication between specific Ericsson hardware and management systems. These protocols were built to run inside carrier networks, not to be documented for public consumption.

The result is a port with a name but no story anyone can tell from the outside. It was registered to prevent collision with other protocols, which is the legitimate purpose of registration. Whether it was ever deployed at scale, or quietly deprecated as 3G and then 4G infrastructure evolved, is not knowable from public records.

What "Registered" Actually Means

The registered port range exists because there are more applications than well-known port slots (0–1023), but the Internet still benefits from coordination. When software vendors or organizations register a port, they're saying: "We intend to use this number. Please don't collide with us."

Registration does not mean:

• The protocol is publicly documented
• The port is in active use anywhere
• The software using it is publicly available

It means IANA logged the claim. Thousands of registered ports sit dormant — relics of software projects that changed direction, protocols that never shipped, or internal systems that have since been retired.

Port 3727 is one of them.

How to Check What's Using This Port

If you see activity on port 3727, it's almost certainly not e-mdu. It's more likely to be software that chose this port arbitrarily, or a dynamic connection that happened to land here.

To inspect it:

On Linux or macOS:

# Show what process is listening on port 3727
ss -tlnp | grep 3727
# or
lsof -i :3727

On Windows:

netstat -ano | findstr :3727

The output will show the process ID. Cross-reference with your process list to identify what's actually running there.