{
  "port": 1718,
  "protocol": "udp",
  "service": "H.323 gatekeeper discovery",
  "oneLiner": "H.323 endpoints shouting for a gatekeeper — multicast discovery, the step before RAS registration on 1719.",
  "whatItIs": "An H.323 endpoint that has not been told where its gatekeeper is sends a GRQ (Gatekeeper Request) to the multicast group 224.0.1.41 on UDP 1718; a gatekeeper that wants the endpoint answers with a GCF, after which all RAS traffic — registration, admission, bandwidth — moves to unicast UDP 1719 and call signalling to TCP 1720. IANA registers 1718 to ITU-T for both TCP and UDP, but the discovery exchange is UDP only. It appears on VoIP networks running legacy H.323 gear: video conferencing MCUs, gateways, and older IP phones.",
  "exposure": {
    "verdict": "never",
    "note": "Gatekeeper discovery is unauthenticated by design and is a link-local mechanism — an endpoint that accepts a GCF from a stranger has just been told where to send its calls, so keep it inside the voice VLAN."
  },
  "checkCommand": "nmap -sU -p 1718 TARGET",
  "links": [
    {
      "title": "ITU-T Recommendation H.323 — Packet-based multimedia communications systems",
      "url": "https://www.itu.int/rec/T-REC-H.323",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1718",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1718",
      "kind": "iana"
    }
  ]
}