{
  "port": 1998,
  "protocol": "tcp",
  "service": "XOT (X.25 over TCP)",
  "oneLiner": "Cisco's X.25-over-TCP tunnel — legacy WAN plumbing that occasionally still answers.",
  "whatItIs": "RFC 1613 defines XOT, which carries X.25 packets inside a TCP stream with a four-byte header, and states that all connections MUST be made to TCP port 1998, a port Cisco registered for the purpose. It exists so routers can bridge X.25 links across an IP network, and it survives mostly in banking, telco, and industrial networks that never finished migrating off X.25. An open 1998 almost always means a Cisco or Cisco-compatible router with XOT configured.",
  "exposure": {
    "verdict": "never",
    "note": "XOT has no authentication or encryption and tunnels straight into a legacy WAN through a router — it belongs on a private link between the two routers that need it."
  },
  "checkCommand": "nc -vz TARGET 1998",
  "links": [
    {
      "title": "RFC 1613 — Cisco Systems X.25 over TCP (XOT)",
      "url": "https://www.rfc-editor.org/rfc/rfc1613.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 1998 (x25-svc-port)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=1998",
      "kind": "iana"
    }
  ]
}