Port 3166: Quest Spotlight — Internal Monitoring Channel

What This Port Does

Port 3166 is registered with IANA under two names, both belonging to Quest Software:

• sossecollector — Quest Spotlight Out-Of-Process Collector (registered 2008-10-23)
• qrepos — Quest Repository

In practice, the port is most clearly documented in Quest Spotlight's own network requirements documentation: TCP 3166 carries traffic between the Spotlight Cloud Diagnostic Server and its Out-Of-Process (OOP) Collector running on the same host. No external connections cross this port. It's localhost IPC, formalized with a registration.¹

The Quest Spotlight Context

Quest Spotlight is a database performance monitoring tool, primarily used for SQL Server environments. Its architecture splits monitoring work across separate processes — the Diagnostic Server handles coordination and reporting, while the OOP Collector does the actual data gathering. Running them separately means a failure in the collector doesn't crash the server.

Port 3166 is the channel between them.

This is why you'll almost never see port 3166 in firewall rules or security audits. It's not meant to traverse a network. If you ever do see it listening on a system, it's either running Quest Spotlight, or something is using the port opportunistically.

What Range This Port Belongs To

Port 3166 sits in the registered ports range (1024–49151). These ports are allocated by IANA to specific services and applications on request. Unlike well-known ports (0–1023), registered ports don't require root or administrator privileges to bind, and their assignments are advisory — nothing forces software to use its registered port, and nothing prevents other software from using an unrelated registered port.

The registered range is enormous. Most of its ~48,000 ports are unassigned. The ones that are assigned often belong to enterprise software that most people have never heard of.

How to Check What's Listening

If you see port 3166 active on a system and aren't running Quest Spotlight, investigate:

macOS / Linux:

# Show the process using port 3166
sudo lsof -i :3166

# Or with ss
sudo ss -tlnp | grep 3166

Windows:

# Show listening ports with process IDs
netstat -aon | findstr :3166

# Then look up the PID
tasklist | findstr <PID>

If nothing is listening, the port is dormant — it's just a number in a registry document.

Why Unassigned (and Quietly Assigned) Ports Matter

The port system only works because most of it is empty. When software needs a communication channel, it reaches for a port number — ideally one that's registered to avoid conflicts, but often one that's simply unused in the environment.

Ports like 3166 represent the quiet majority: registered to something real, used rarely, unknown to most administrators. Understanding the registered range helps you distinguish the expected from the suspicious — and recognize that "I've never heard of this port" and "this port is malicious" are very different statements.