{
  "port": 15002,
  "protocol": "tcp",
  "service": "onep-tls (Cisco) / Istio failure detection",
  "oneLiner": "Cisco's Open Network Environment TLS port by registration; inside a service mesh it is the sidecar's failure-detection listener.",
  "whatItIs": "IANA registered 15002/TCP in January 2014 to Cisco as `onep-tls`, \"Open Network Environment TLS\" — the TLS transport for onePK, Cisco's programmability SDK for IOS/IOS-XE, which has since been superseded by NETCONF/RESTCONF and gNMI and is no longer a live product. The UDP side is Reserved. The number's current relevance is Istio, which lists 15002 among its sidecar ports as the \"listen port for failure detection\" and marks it pod-internal only, sitting in the same 15000-15099 block as the Envoy admin (15000), outbound (15001) and inbound (15006) listeners.",
  "exposure": {
    "verdict": "never",
    "note": "Both readings are internal control paths — a network-device programmability channel or a mesh-internal probe port. Neither should be reachable from outside the pod or the management network."
  },
  "checkCommand": "nmap -Pn -sV -p 15002 TARGET",
  "links": [
    {
      "title": "Istio — ports used by Istio",
      "url": "https://istio.io/latest/docs/ops/deployment/application-requirements/",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 15002 (onep-tls)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=15002",
      "kind": "iana"
    }
  ]
}