Two unrelated things share this port: DNP3, the electric-utility SCADA protocol, and Usermin's HTTPS admin interface.
IANA registers 20000 as 'dnp' for DNP3, the master/outstation protocol used between substation computers, RTUs and IEDs in electric utilities, water systems, and oil and gas; it is standardised as IEEE 1815 and DNP3-over-IP runs on TCP 20000. Independently, Usermin — the end-user companion to Webmin — defaults to HTTPS on 20000, so a scan hit is very often a Unix box offering webmail and password changes rather than a substation. The two are trivially told apart: Usermin answers a TLS handshake and serves HTML, DNP3 does not. On a general-purpose server assume Usermin; on an OT network assume DNP3.
Do not expose
DNP3 has no authentication or encryption in its base form and speaks directly to physical plant. Usermin is a user-facing admin plane. Neither belongs on a public IP — put both behind a VPN.
$ nmap -Pn -sV -p 20000 --reason TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.