{
  "port": 12000,
  "protocol": "both",
  "service": "entextxid (IBM Enterprise Extender)",
  "oneLiner": "IBM Enterprise Extender's SNA XID exchange — the first of the 12000-12004 block that carries SNA traffic over IP.",
  "whatItIs": "IANA registers 12000 as `entextxid`, \"IBM Enterprise Extender SNA XID Exchange\", the head of a five-port block: 12001 `entextnetwk`, 12002 `entexthigh`, 12003 `entextmed` and 12004 `entextlow` carry the four SNA classes of service. Enterprise Extender tunnels SNA/APPN over UDP so mainframes and their peers keep talking after the SNA network itself is retired, which is why the live traffic is UDP on 12000-12004 rather than a TCP listener. Nmap's database also carries the legacy alias `cce4x` for ClearCommerce Engine 4.x, a long-defunct payments product. Separately, 12000 is a round number that developers pick constantly for application and API listeners, so on a non-mainframe host it is far more likely to be someone's app server than SNA.",
  "exposure": {
    "verdict": "never",
    "note": "Enterprise Extender is a datacenter-to-datacenter transport for mainframe traffic and belongs on private links or a VPN. If instead it is an app server that happened to pick 12000, judge that app on its own terms."
  },
  "checkCommand": "nmap -Pn -sV -p 12000 TARGET",
  "links": [
    {
      "title": "IANA port registry — 12000-12004 (entextxid and the SNA COS ports)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=entext",
      "kind": "iana"
    }
  ]
}