Port 3582: PEG PRESS Server — A Ghost Registration

What Is Port 3582?

Port 3582 is a registered port. It sits in the registered port range (1024 to 49151), the middle tier of the port numbering system where IANA assigns numbers to specific services on request.

According to the IANA Service Name and Transport Protocol Port Number Registry, port 3582 was registered in August 2002 by Jim DeLisle of Swell Software for a product called PEG PRESS Server. The service name is listed as press, covering both TCP and UDP. ¹

That is all the official record says. And that is all anyone can find.

The Ghost Port Phenomenon

Swell Software no longer has a web presence. PEG PRESS Server has no surviving documentation. There are no archived product pages, no forum posts, no RFCs, no protocol specifications. Whatever PEG PRESS Server was, perhaps a publishing system, a content delivery tool, something related to PEG (public, educational, and government) television channels, it left no trace worth searching for.

This is not unusual. IANA registrations are permanent. A company fills out the paperwork, receives a port assignment, and that assignment stays in the registry indefinitely, regardless of what happens to the company or the product. Port 3582 is one of hundreds of registered ports where the assignee has since dissolved, the software has been abandoned, and the port exists in a kind of permanent administrative twilight.

In practice, this means port 3582 behaves like an unassigned port. No software actively uses it by convention. Your system almost certainly has nothing listening on it.

The Registered Port Range

The registered range (1024 to 49151) exists between the well-known ports below 1024 (HTTP, SSH, DNS) and the dynamic/ephemeral ports above 49151 that operating systems hand out for short-lived connections.

Registered ports are meant to be stable, named homes for specific services. The assignment process exists so that software developers can claim a port number and document its use, preventing conflicts. In theory, if you see traffic on port 3582, it is for PEG PRESS Server. In practice, if you see traffic on port 3582, it is almost certainly something else: a developer who picked a convenient number, an application with a default configuration, or a port scanner.

What to Do If You See Port 3582 Open

If you find something listening on port 3582 on your own system, it is not PEG PRESS Server. Identify it:

On macOS or Linux:

lsof -i :3582

On Windows:

netstat -ano | findstr :3582

The output will show you the process ID. From there, you can look up which application owns it.