{
  "port": 1494,
  "protocol": "tcp",
  "service": "Citrix ICA",
  "oneLiner": "Citrix ICA/HDX — the remote display protocol carrying a published desktop or app to the client.",
  "whatItIs": "ICA (Independent Computing Architecture), marketed as HDX, is the protocol between a Citrix client and a Virtual Delivery Agent, carrying screen updates, input, audio, printing and drive mapping in virtual channels. TCP 1494 is the default; when Session Reliability is enabled, the client instead connects to TCP 2598, where the Common Gateway Protocol wraps the same ICA stream so a brief network drop does not kill the session. Citrix treats both as fixed ports. An open 1494 identifies a Citrix VDA or session host.",
  "exposure": {
    "verdict": "never",
    "note": "Do not publish raw 1494 to the internet — Citrix's own answer is ICA over TLS via a gateway on 443, which also gives you authentication in front of the session."
  },
  "checkCommand": "nmap -Pn -p 1494,2598 TARGET",
  "links": [
    {
      "title": "Citrix — Linux Virtual Delivery Agent network port matrix (ICA/HDX on TCP 1494, 2598 with Session Reliability)",
      "url": "https://docs.citrix.com/en-us/linux-virtual-delivery-agent/current-release/configure/administration/network-port-matrix.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}