{
  "port": 2003,
  "protocol": "tcp",
  "service": "Graphite carbon (plaintext)",
  "oneLiner": "Graphite's plaintext metrics receiver — one metric per line, no authentication at all.",
  "whatItIs": "IANA currently registers 2003 as brutus, and older /etc/services files call it cfingerd or GNU finger, but on a modern host this is Graphite: carbon-cache's plaintext line receiver runs on 2003 by default and accepts lines of the form \"metric.path value timestamp\". Anything that ships metrics — collectd, StatsD backends, Diamond, application code — writes here. If 2003 is open on a monitoring box, it is the metrics firehose inlet.",
  "exposure": {
    "verdict": "never",
    "note": "The plaintext protocol has no authentication and no rate limiting, so anyone who can reach it can poison your metrics or fill the disk with new whisper files — bind it to the private network."
  },
  "checkCommand": "printf 'whatport.test 1 %s\\n' \"$(date +%s)\" | nc -w 2 TARGET 2003",
  "links": [
    {
      "title": "Graphite documentation — Feeding In Your Data (plaintext, port 2003)",
      "url": "https://graphite.readthedocs.io/en/latest/feeding-carbon.html",
      "kind": "official-docs"
    },
    {
      "title": "graphite-project/carbon",
      "url": "https://github.com/graphite-project/carbon",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 2003 (brutus)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=2003",
      "kind": "iana"
    }
  ]
}