{
  "port": 10009,
  "protocol": "both",
  "service": "swdtp-sv / lnd gRPC",
  "oneLiner": "Registered to Fujitsu Systemwalker, but today it is most often lnd's Lightning Network gRPC API.",
  "whatItIs": "IANA assigns 10009 to swdtp-sv, the server side of Fujitsu's Systemwalker Desktop Patrol asset-management product. The listener you are more likely to meet is lnd, the Lightning Network daemon, whose shipped sample configuration sets `rpclisten=localhost:10009` for its gRPC interface (its REST API sits on 8080). Nmap sees 10009/tcp open on about 0.02% of hosts. A TLS handshake that presents a self-signed lnd certificate is the giveaway.",
  "exposure": {
    "verdict": "never",
    "note": "lnd's gRPC controls a Bitcoin wallet and its channel funds. It is macaroon-authenticated over TLS, but macaroons leak and there is no reason to expose it — keep it on localhost or behind a VPN."
  },
  "checkCommand": "nc -vz TARGET 10009",
  "links": [
    {
      "title": "lnd — sample-lnd.conf (rpclisten default localhost:10009)",
      "url": "https://github.com/lightningnetwork/lnd/blob/master/sample-lnd.conf",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 10009 (swdtp-sv)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=10009",
      "kind": "iana"
    }
  ]
}