Registered to Fujitsu Systemwalker, but today it is most often lnd's Lightning Network gRPC API.
IANA assigns 10009 to swdtp-sv, the server side of Fujitsu's Systemwalker Desktop Patrol asset-management product. The listener you are more likely to meet is lnd, the Lightning Network daemon, whose shipped sample configuration sets rpclisten=localhost:10009 for its gRPC interface (its REST API sits on 8080). Nmap sees 10009/tcp open on about 0.02% of hosts. A TLS handshake that presents a self-signed lnd certificate is the giveaway.
Do not expose
lnd's gRPC controls a Bitcoin wallet and its channel funds. It is macaroon-authenticated over TLS, but macaroons leak and there is no reason to expose it — keep it on localhost or behind a VPN.
$ nc -vz TARGET 10009Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.