Internet-Security raven logo internet-security.com

TCP 3399

ProtocolTCP
Port3399
Labels

Synopsis

  • TCP 3399 is used by SAP NetWeaver’s ABAP Gateway service (service name sapgwNN), where NN is the instance number; 3399 corresponds to sapgw99.
  • It carries SAP RFC and CPI-C traffic between SAP application servers and clients/tools such as SAP GUI and SAProuter, and for integrations calling SAP RFCs.
  • Example: An SAP ECC or S/4HANA application server with instance number 99 will listen on TCP 3399 for RFC-based communications.
  • Security note: Misconfigured SAP Gateway access controls (reginfo/secinfo) have been widely exploited (e.g., in the 10KBLAZE attacks) to execute unauthorized RFC calls or OS commands, so exposed 33NN ports, including 3399, are frequent targets.

Observed activity

Last 30 days Detailed chart

More information