{
  "port": 1720,
  "protocol": "tcp",
  "service": "H.323 call signalling (Q.931)",
  "oneLiner": "H.323 call setup — a video conferencing system, VoIP gateway, or PBX willing to take a call.",
  "whatItIs": "TCP 1720 carries H.225.0 call signalling, a Q.931-derived message set: SETUP, ALERTING, CONNECT, RELEASE COMPLETE. Once a call is accepted, H.245 negotiates capabilities and the audio and video themselves flow over RTP on dynamic UDP ports, so 1720 is only the front door. It is the standard listening port for H.323 gateways, gatekeepers, MCUs, and the video conferencing endpoints from Polycom, Cisco/Tandberg, and Lifesize. H.323 predates SIP and survives mostly in video conferencing rooms and in PSTN gateways.",
  "exposure": {
    "verdict": "never",
    "note": "An H.323 endpoint reachable from the internet is a standing toll-fraud and auto-answer target — signalling is cleartext, vendor firmware ships weak or default credentials, and scanners sweep 1720 continuously. Front it with an H.323 session border controller."
  },
  "checkCommand": "nmap -sV -p 1720 TARGET",
  "links": [
    {
      "title": "ITU-T Recommendation H.323 — Packet-based multimedia communications systems",
      "url": "https://www.itu.int/rec/T-REC-H.323",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1720",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1720",
      "kind": "iana"
    }
  ]
}