{
  "port": 1026,
  "protocol": "both",
  "service": "CAP (Calendar Access Protocol) / Windows dynamic RPC",
  "oneLiner": "Registered to the experimental Calendar Access Protocol, but in practice it is almost always a dynamically assigned Windows RPC endpoint.",
  "whatItIs": "IANA assigns 1026 to `cap`, the Calendar Access Protocol, an experimental protocol (RFC 4324, 2005) that carried iCalendar operations over BEEP; the RFC names 1026 as the default port a Calendar Store listens on. CAP was never widely implemented and you will effectively never meet one. What you do meet on 1026 is a Windows box: Windows 2000, XP and Server 2003 allocated dynamic RPC and DCOM endpoints out of a low range starting at 1025, so 1026 is one of the first ports handed to whatever RPC service starts early, and nmap fingerprints it as `msrpc`. Vista and Server 2008 moved that range to 49152-65535, so a modern host answering here is running something else entirely.",
  "exposure": {
    "verdict": "never",
    "note": "The realistic listener is a Windows DCE/RPC endpoint, which has no business on a public IP; and since the binding is dynamic you cannot know what service is behind it without asking the endpoint mapper on 135."
  },
  "checkCommand": "nmap -Pn -sV -p 1026 TARGET",
  "links": [
    {
      "title": "RFC 4324 — Calendar Access Protocol (CAP)",
      "url": "https://www.rfc-editor.org/rfc/rfc4324.html",
      "kind": "spec"
    },
    {
      "title": "Microsoft — Service overview and network port requirements (dynamic port ranges)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}