{
  "port": 1002,
  "protocol": "tcp",
  "service": "Unassigned — nmap labels it windows-icfw",
  "oneLiner": "Unassigned at IANA; scanners print \"windows-icfw\" from an old Windows-era name, not from anything running today.",
  "whatItIs": "1002 sits in IANA's unassigned 1002–1007 block, so there is no registered service. nmap's service table still carries the historical label windows-icfw, annotated as the Windows Internet Connection Firewall or the Internet Locator Server used by NetMeeting, and that is the name most scan reports repeat. Neither is a live protocol on modern systems. Being under 1024, a listener here was started by a privileged process, so it is deliberate.",
  "exposure": {
    "verdict": "careful",
    "note": "The scanner's label is a historical guess, not evidence. Identify the actual service before you decide anything about exposing it."
  },
  "checkCommand": "sudo lsof -nP -iTCP:1002 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry (1002–1007 unassigned)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services (1002/tcp windows-icfw)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}