Cisco's X.25-over-TCP tunnel — legacy WAN plumbing that occasionally still answers.
RFC 1613 defines XOT, which carries X.25 packets inside a TCP stream with a four-byte header, and states that all connections MUST be made to TCP port 1998, a port Cisco registered for the purpose. It exists so routers can bridge X.25 links across an IP network, and it survives mostly in banking, telco, and industrial networks that never finished migrating off X.25. An open 1998 almost always means a Cisco or Cisco-compatible router with XOT configured.
Do not expose
XOT has no authentication or encryption and tunnels straight into a legacy WAN through a router — it belongs on a private link between the two routers that need it.
$ nc -vz TARGET 1998Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.