Port 3236: appareNet Test Server — a ghost in the registry

What Port 3236 Is

Port 3236 carries the IANA service name apparenet-ts — the appareNet Test Server. It operates on both TCP and UDP. ¹

"appareNet" was network performance monitoring software built by a Vancouver startup originally called Jaalam Research, later renamed Apparent Networks in 2003. The software used a dedicated port to run active network tests — injecting probe traffic, measuring how it traversed the network, and reporting back on latency, packet loss, and path behavior. ²

The company was renamed AppNeta in 2011. Broadcom acquired AppNeta in December 2021. ³

The port remains in the IANA registry. The software that claimed it has been through four names and two acquisitions.

What Range This Port Belongs To

Port 3236 sits in the registered ports range (1024–49151). These ports are:

• Not reserved for the operating system (unlike well-known ports 0–1023, which require elevated privileges)
• Registered with IANA by organizations or vendors who need a stable, documented port for their software
• Not guaranteed to be in active use — registration doesn't expire, and products outlive their ports

Registration means someone asked IANA for this number and got it. It does not mean the software is still running anywhere.

Citrix and the Neighborhood

Port 3236 also sits inside a range that Citrix uses informally. Citrix NetScaler Gateway uses UDP ports 3224–3324 for XenDesktop and XenApp Framehawk connections — a protocol Citrix developed for delivering virtual desktops over lossy networks. ⁴

If you see port 3236 UDP traffic in a Citrix environment, that's probably Framehawk, not appareNet.

How to Check What's Listening

To see if anything is actually using port 3236 on your machine:

macOS / Linux:

sudo lsof -i :3236

Windows:

netstat -ano | findstr :3236

If nothing is returned, nothing is listening. That's the expected result for most systems.

Why Unassigned-ish Ports Matter

The IANA port registry is not a live inventory of active services. It's closer to a claims database. Someone staked this number in the early 2000s, and the claim sits there regardless of whether the software still runs.

This matters for two reasons:

1. Security scanning: When a port scanner finds unexpected traffic on port 3236, knowing the registered service gives you a starting point — even if the real answer is "Citrix Framehawk" or "something custom."

2. Port conflicts: Developers choosing ports for internal services should avoid registered numbers, even obscure ones. Running something on 3236 could conflict with Citrix environments or any remaining appareNet deployments.

The registered ports range is large (48,127 ports). Most of them look like this: technically claimed, practically quiet, occasionally borrowed by something that needed a number and didn't check the neighbors.