Port 3666: IBM eServer PAP — A Registered Ghost

What This Port Is

Port 3666 sits in the registered ports range (1024–49151). These ports are allocated by IANA to specific services — not reserved like well-known ports (0–1023), but recognized and documented. Any service can technically use any port, but registered ports have a named owner on file.

Port 3666's owner: IBM eServer PAP — the IBM eServer Provisioning and Administration Protocol, registered in January 2003. It runs on both TCP and UDP.

What IBM eServer PAP Was

IBM's eServer line was a family of enterprise servers sold in the early 2000s — xSeries, iSeries, pSeries, zSeries. The PAP protocol handled remote provisioning and administration: installing operating systems, configuring hardware, managing firmware across data centers full of IBM iron.

The eServer brand was retired in 2006 when IBM consolidated under the System x, System i, System p, and System z names. Those lines were eventually sold to Lenovo in 2014.

The protocol is gone. The port number remains, frozen in the IANA registry like a timestamp.

Who's Looking for It

According to the SANS Internet Storm Center, port 3666 still receives active scanning from machines around the world. This is normal for any registered port — automated scanners sweep entire port ranges looking for anything that responds, regardless of whether the service is still in use.

If you see traffic on port 3666 and you're not running a 20-year-old IBM provisioning stack, it's almost certainly a scanner, not a legitimate service.

What to Check If You See Activity

To find what's listening on port 3666 on your machine:

Linux / macOS:

ss -tlnp | grep 3666
# or
lsof -i :3666

Windows:

netstat -aon | findstr :3666

The output will show the process ID (PID) and the binary behind it. On any modern system, nothing should be listening here.

Why This Port Exists at All

The registered port range exists as a courtesy system. IANA doesn't enforce exclusive use — it just keeps a record, so network administrators can look up an unfamiliar port and learn what it was meant for. Port 3666 in a packet capture means: check if you have old IBM provisioning software, then assume it's a scanner.

The registry is a historical document as much as a technical one. Port 3666 is proof that protocols outlive the hardware they were built for.