{
  "port": 1009,
  "protocol": "tcp",
  "service": "Unassigned",
  "oneLiner": "Unassigned at IANA, with no service name and no convention — identify by banner or not at all.",
  "whatItIs": "IANA lists 1009 explicitly as Unassigned. Its neighbour is a small piece of registry folklore: 1008/udp carries the comment \"Possibly used by Sun Solaris????\", which is as much certainty as this stretch of the registry offers. nmap has 1009/tcp as unknown and very rarely open. Anything answering is a local choice, and because the port is below 1024 the process that bound it had root.",
  "exposure": {
    "verdict": "careful",
    "note": "No registration and no convention means no assumptions — fingerprint the listener before treating it as benign."
  },
  "checkCommand": "sudo lsof -nP -iTCP:1009 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry (1009 Unassigned)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services (1009/tcp unknown)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}