{
  "port": 1100,
  "protocol": "tcp",
  "service": "MCTP (IANA) / JBoss HA-JNDI",
  "oneLiner": "Registered to MCTP, but in the field this is the clustered JBoss HA-JNDI naming port sitting one above 1099.",
  "whatItIs": "IANA registers 1100 as mctp. What actually shows up on scans is JBoss Application Server's clustered naming service: the HA-JNDI configuration guide states that the Port attribute \"to which the HA-JNDI server will bind waiting for JNP clients\" defaults to 1100, with the RMI stub port defaulting to 1101. So finding 1100 open usually means a clustered legacy JBoss/EAP node, and 1098, 1099 and 1101 are typically open alongside it. HA-JNDI lets clients read and write the JNDI tree, which is why it has a long CVE history.",
  "exposure": {
    "verdict": "never",
    "note": "A reachable JNDI naming service lets attackers manipulate bindings and pull in remote objects; keep the whole 1098-1101 cluster range on a private network."
  },
  "checkCommand": "nmap -Pn -p 1098-1101 -sV TARGET",
  "links": [
    {
      "title": "JBoss Server Configuration Guide — Clustered JNDI (HA-JNDI) configuration",
      "url": "https://docs.jboss.org/jbossas/docs/Server_Configuration_Guide/4/html/clustering-jndi-jboss.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}