{
  "port": 113,
  "protocol": "tcp",
  "service": "ident / auth",
  "oneLiner": "The Ident protocol — a server asks your host \"who owns this outbound connection?\"",
  "whatItIs": "Ident, RFC 1413, answers a query naming a local and remote port pair with the username that owns that TCP connection. IRC servers and some old SMTP and FTP daemons query it when you connect, which is why an IRC connection stalls a few seconds when 113 is filtered rather than refused. The answer is entirely self-reported by the client's host, so it is a hint, not authentication — RFC 1413 says so itself. Modern hosts usually have nothing listening, and oidentd exists for people who want to answer anyway.",
  "exposure": {
    "verdict": "careful",
    "note": "Harmless by design but it leaks local usernames to anyone who asks. If you filter it, REJECT rather than DROP so clients fail fast instead of waiting for a timeout."
  },
  "checkCommand": "nc -vz TARGET 113",
  "links": [
    {
      "title": "RFC 1413 — Identification Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc1413.html",
      "kind": "spec"
    },
    {
      "title": "oidentd source repository",
      "url": "https://github.com/solbu/oidentd",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}