{
  "port": 1110,
  "protocol": "both",
  "service": "nfsd-status / webadmstart",
  "oneLiner": "Split registration: TCP is \"start web admin server\", UDP is NFS client status — and Nmap labels the TCP side nfsd-status.",
  "whatItIs": "IANA registers 1110/tcp as webadmstart (\"Start web admin server\") and 1110/udp as nfsd-keepalive (\"Client status info\"), which is why Nmap's service list calls the TCP side nfsd-status and carries both names in its comments. It is the most frequently observed port in this block, historically alongside NFS status-monitor traffic on Solaris and other Unix hosts. Both readings of the registration point at infrastructure you would not publish: an administrative bootstrap endpoint or NFS-adjacent status.",
  "exposure": {
    "verdict": "never",
    "note": "Either an admin-server hook or NFS status plumbing — both are internal-only. NFS-family services on a public IP are a long-standing compromise route."
  },
  "checkCommand": "sudo lsof -nP -iTCP:1110 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services (port name and frequency data)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}