Port 3520: Galileolog — A Registered Ghost with a Netrek Heartbeat

What This Port Is

Port 3520 sits in the registered port range (1024–49151). IANA assigned it in June 2002 to a service called galileolog — the Netvion Galileo Log Port.¹

Netvion's Galileo product let HP OpenView Network Node Manager discover and manage devices through Cisco PIX firewalls — essentially, a way to see through a firewall without punching holes in it. Port 3519 handled the main Galileo service; port 3520 handled logging.

Netvion is gone. The software is gone. The registration remains, an artifact in IANA's registry pointing at a company that no longer answers.

What Actually Uses It

While galileolog exists only on paper, port 3520 has a second life: the Netrek metaserver.

Netrek is a multiplayer space game that dates to 1988, one of the earliest real-time network games on the Internet.² Players pilot starships, conquer planets, and fight for galactic supremacy in matches that predate the World Wide Web. It still runs.

The Netrek metaserver — a central directory of active game servers — listens on several ports, each serving a different format:

Port 3520 is the original. To see it working, you can still do this:

telnet metaserver.us.netrek.org 3520

You'll get back a plain-text list of active Netrek servers, in a format that hasn't meaningfully changed in decades. The protocol predates HTTP. It just works.

How to Check What's Listening on This Port

If you see traffic on port 3520 on your own system:

# macOS / Linux — see what process owns the port
sudo lsof -i :3520

# Linux — alternative
ss -tlnp | grep 3520

# Windows
netstat -ano | findstr :3520

Unexpected activity on port 3520 almost certainly isn't galileolog (that software is long dead) or Netrek (you'd know if you were running a game server). Unknown processes listening on unfamiliar ports are worth investigating.

Why Unassigned-in-Practice Ports Matter

The registered port range exists so that software authors can claim a port, reducing collisions. But registrations outlive companies, products get abandoned, and the registry accumulates ghosts.

Port 3520 is a clean example: officially spoken for, practically empty of its registered occupant, quietly carrying something entirely different. This is the normal entropy of the port system. IANA doesn't reclaim abandoned registrations — it just leaves them there, a historical record of software that once mattered enough to claim a number.

The Netrek use of port 3520 is unofficial but harmless — the game has used it long enough that it's become convention. No one is confused. The original tenant isn't coming back.