{
  "port": 1,
  "protocol": "tcp",
  "service": "TCPMUX",
  "oneLiner": "A 1988 service multiplexer: connect, send a service name, and the server hands you that service on the same socket.",
  "whatItIs": "TCPMUX lets a host offer many small services behind one port. A client connects to 1, sends a service name terminated by CRLF, and the server replies '+' or '-' before handing the connection to the named service. It shipped as an inetd built-in on several classic UNIX systems and is effectively extinct today. Anything answering on port 1 is either a deliberately exotic setup or a scanner artifact, and the port is a routine early entry in mass port sweeps.",
  "exposure": {
    "verdict": "never",
    "note": "By design it is a directory that dispatches into other local services, so exposing it exposes whatever is registered behind it."
  },
  "checkCommand": "sudo lsof -nP -iTCP:1 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 1078 — TCP Port Service Multiplexer (TCPMUX)",
      "url": "https://www.rfc-editor.org/rfc/rfc1078.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}