Unassigned at IANA; scanners print "windows-icfw" from an old Windows-era name, not from anything running today.
1002 sits in IANA's unassigned 1002–1007 block, so there is no registered service. nmap's service table still carries the historical label windows-icfw, annotated as the Windows Internet Connection Firewall or the Internet Locator Server used by NetMeeting, and that is the name most scan reports repeat. Neither is a live protocol on modern systems. Being under 1024, a listener here was started by a privileged process, so it is deliberate.
Expose with care
The scanner's label is a historical guess, not evidence. Identify the actual service before you decide anything about exposing it.
$ sudo lsof -nP -iTCP:1002 -sTCP:LISTENSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.