{
  "port": 11111,
  "protocol": "both",
  "service": "vce (IANA) / ricci in practice",
  "oneLiner": "Registered to the Viral Computing Environment; in real deployments it is Red Hat's `ricci` cluster agent, or a hand-picked repdigit port.",
  "whatItIs": "IANA assigns 11111 on TCP and UDP to `vce`, the Viral Computing Environment, an old distributed-computing research project of Fred Cohen's that you will not meet on a modern network. It is widely reported as the port of `ricci`, the node-side agent of Red Hat's long-retired `luci`/`ricci` cluster management stack, which the `luci` console used to manage cluster nodes; no current vendor documentation covers it, so treat that as received wisdom rather than a specification. Beyond that, 11111 is one of the repdigit numbers people reach for when they need an arbitrary port for a proxy, a test listener, or a container mapping, so a match here often means nothing more than someone typed five ones.",
  "exposure": {
    "verdict": "never",
    "note": "If it is `ricci`, it is a node-configuration channel for a cluster — management network only. If it is an ad-hoc listener, you still do not know what it is until you fingerprint it."
  },
  "checkCommand": "nmap -Pn -sV -p 11111 TARGET",
  "links": [
    {
      "title": "IANA port registry — 11111 (vce)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=11111",
      "kind": "iana"
    }
  ]
}