Port 3626: bvControl Daemon — A Registered Port Whose Owner Disappeared

What Port 3626 Is

Port 3626 sits in the registered ports range (1024–49151), the middle tier of the port numbering system. These ports are assigned by IANA (the Internet Assigned Numbers Authority) to specific services upon application — they're claimed, named, and recorded. Unlike the well-known ports below 1024, registered ports don't require root privileges to bind, and unlike the ephemeral ports above 49151, they're not randomly assigned to outgoing connections.

Port 3626 is officially registered. The service name is bvcontrol, formally listed as bvcdaemon-port. IANA shows the assignment date as October 2002.¹

What bvControl Was

BindView Corporation — then a publicly traded company on NASDAQ (ticker: BVEW) — made IT security compliance software. Their flagship product, bv-Control, was an agentless network management suite for Windows environments. "Agentless" was the selling point: administrators could audit and manage machines across the network without installing software on each individual machine.²

The bvControl Daemon was the background process that made this remote management possible. Port 3626 is the door it listened at.

In October 2005, Symantec announced it would acquire BindView for $209 million in cash. The deal closed on January 6, 2006.³ The bv-Control product line was absorbed and eventually discontinued. Port 3626's entry in the IANA registry was never updated. It still reads: BindView.

Who Uses Port 3626 Today

Almost certainly nobody, in the original sense. The software is gone. Any traffic you see on port 3626 is either:

• Legacy infrastructure from an organization that somehow still runs two-decade-old BindView software
• Coincidental — a custom application or developer tool that chose this port without knowing its history
• A port scanner probing it out of habit

There are no known associations with malware or exploitation specific to this port.

Checking What's on Port 3626

If you see activity on port 3626 and want to know what's actually using it:

Linux / macOS:

# See what process is listening
sudo lsof -i :3626

# Or with ss (faster on modern Linux)
sudo ss -tlnp | grep 3626

Windows:

netstat -ano | findstr :3626

Then match the PID from the last column against Task Manager or:

tasklist | findstr <PID>

Why Unassigned-ish Ports Matter

The IANA registry exists so that software doesn't step on itself. If every application picked a port at random, collisions would be constant. But the registry is only as useful as its maintenance — and registered ports for defunct software are, in effect, squatted. The name is claimed but the building is empty.

Port 3626 is a minor lesson in how technical standards outlive the organizations that created them. The Internet keeps books on everything, forever.

Related Ports

• Port 3625 — unassigned
• Port 3627 — unassigned
• Port 1236 — also listed in some sources as a bvControl-related port