"3478/udp" read as one token was not a port, so it passed through and the runtime published it wherever it liked: on ace, unifi's STUN and discovery landed on random machine ports while every TCP pin beside them held. The protocol is split off, the number is assigned as for any short form, and the suffix rides along on the outside.