Port 3275: SAMD — Registered, Undocumented

What This Port Is

Port 3275 sits in the registered port range (1024-49151), the middle tier of the 65,535-port address space. Registered ports are supposed to be assigned by IANA to specific services after a review process, distinguishing them from the well-known system ports (0-1023) that run SSH, HTTP, and DNS, and from the ephemeral ports (49152-65535) that operating systems hand out dynamically to outgoing connections.

The IANA registry lists port 3275 as assigned to a service called "samd" on both TCP and UDP, with a contact name of Edgar Circenis. That's the entirety of the public record. No RFC defines it. No specification has been published. No product documentation references it. SAMD means nothing that can be verified.¹

A Ghost Registration

The registered port range has thousands of entries like this one. Someone filed the IANA paperwork, received an assignment, and then the protocol — if it ever existed — never made it into public documentation. The port got a name without getting a story.

This isn't unusual. The IANA registry is a first-come, first-served system with more administrative friction than technical rigor. A registration means someone asked for the port, not that the port carries real traffic.

What's Actually on This Port

If you see port 3275 active on a system you manage, it isn't "SAMD" — because SAMD has no known implementation. It's something else: a custom application, a vendor-specific service, or possibly software that picked this port because it was obscure and uncontested.

To find out what's actually listening:

On Linux or macOS:

sudo ss -tlnp | grep 3275
# or
sudo lsof -i :3275

On Windows:

netstat -ano | findstr :3275
# Then look up the PID:
tasklist | findstr <PID>

These commands tell you the process name and ID — which gives you the actual answer.

Why Unassigned-in-Practice Ports Matter

A registered-but-undocumented port is a useful reminder that the port registry is a coordination mechanism, not a guarantee of behavior. Real traffic on port 3275 tells you nothing about what protocol is running — you have to inspect it directly.

This matters for firewall policy. Blocking or allowing a port based on its IANA name assumes the name corresponds to a known protocol. With ports like 3275, that assumption breaks down. Trust what's actually on the wire, not what the registry says.