The TLS management channel that ISS security appliances and sensors use to report to a SiteProtector console.
IANA registers 3995 as iss-mgmt-ssl, "ISS Management Svcs SSL". Internet Security Systems built RealSecure sensors and the SiteProtector management console; IBM acquired ISS and carried the architecture into the Proventia line. IBM's Proventia documentation gives 3995 as the default port for alerts sent to the SiteProtector system, and notes that the appliance trusts connections arriving on it. On a scan it marks an intrusion-detection or -prevention deployment of that generation.
Do not expose
The vendor's own documentation says the appliance trusts connections on this port — a security management plane that trusts its peers must be reachable only from those peers, on an isolated network.
$ openssl s_client -connect TARGET:3995 -brief </dev/nullSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.