What Port 3140 Is
Port 3140 sits in the registered port range — the band of ports from 1024 to 49151 that IANA assigns to specific services on request. Unlike the well-known ports below 1024 (HTTP at 80, HTTPS at 443, SSH at 22), registered ports don't require root privileges to bind, and their assignments aren't always to software anyone actually uses.
Port 3140 is registered to Arilia Multiplexor (IANA service name: ariliamulti) on both TCP and UDP. 1
If you've never heard of Arilia Multiplexor, you're not alone. It has essentially no presence in technical documentation, open-source software, or vendor releases. It's a ghost registration — the name sits in the IANA database, but the service, company, or protocol behind it left no footprint.
This happens. The registered port range is large, registration is relatively straightforward, and not every service that claimed a port in the 1990s or 2000s survived long enough to matter.
The MyDoom Shadow
Port 3140 has a second association, more notorious than its tenant.
In January 2004, the MyDoom worm spread through email at a rate that briefly made it the fastest-spreading worm ever recorded. Among other things, MyDoom installed a backdoor on infected machines by opening a listener on a port somewhere in the range of 3127 to 3198 — selected randomly per infection. Attackers could then connect to infected hosts through whichever port the worm chose, execute arbitrary code, and use the machine as a proxy. 2
Port 3140 sits squarely in that range. If you see unexpected traffic on this port, it's worth ruling out something old and malicious before concluding it's something new and benign.
MyDoom is largely dormant now — most of its original command infrastructure is long dead — but old infections occasionally still turn up on unpatched or forgotten machines.
What Range This Port Belongs To
| Range | Name | Notes |
|---|---|---|
| 0–1023 | Well-known ports | Assigned by IANA; require root to bind |
| 1024–49151 | Registered ports | Assigned by IANA on request; port 3140 lives here |
| 49152–65535 | Dynamic/ephemeral ports | Used for outbound connections; not assigned |
The registered range exists to give applications a consistent, predictable port to listen on without conflicting with core infrastructure. When an application registers a port, it's staking a claim: "this is where you find me." The system works when the claiming service is real and widely deployed. When it isn't, you get entries like Arilia Multiplexor — placeholders that mean nothing in practice.
How to Check What's Listening on Port 3140
If you want to see whether anything on your machine is using this port:
Linux / macOS:
Windows:
The output will show you the process ID (PID) of anything listening. On Linux, ss -tlnp includes the process name directly. On Windows, take the PID to Task Manager or run tasklist | findstr <PID> to identify the process.
If something unexpected is listening here on a server you didn't configure, treat it as suspicious until you know otherwise.
此页面对您有帮助吗？