{
  "port": 1023,
  "protocol": "tcp",
  "service": "Reserved — top of the system port range",
  "oneLiner": "IANA-reserved, and the last port of the privileged 0–1023 range that only root may bind on Unix.",
  "whatItIs": "RFC 6335 defines 0–1023 as the System (well-known) ports, which on Unix-like systems only a privileged process may bind, and IANA holds 1023 itself Reserved rather than assigning it. So no standard service lives here. Where 1023 does show up is as a source port: rsh, rlogin and NFS-era clients deliberately chose a reserved source port in 512–1023 as proof the caller was root on a trusted host. A listener on 1023 is a deliberate choice by something running with privilege.",
  "exposure": {
    "verdict": "careful",
    "note": "No assigned service means nothing to allow by default. The privileged-source-port convention it belongs to was host-based trust, which is not a security control on a modern network."
  },
  "checkCommand": "sudo lsof -nP -iTCP:1023",
  "links": [
    {
      "title": "RFC 6335 — Port ranges: System (0–1023), User, and Dynamic",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry (1023 Reserved)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}