{
  "port": 2065,
  "protocol": "tcp",
  "service": "DLSw read port",
  "oneLiner": "Data Link Switching — SNA and NetBIOS traffic tunnelled between routers over TCP.",
  "whatItIs": "DLSw carries IBM SNA and NetBIOS frames across an IP backbone by terminating the local link control at each router and tunnelling over TCP. RFC 1795 defines the default socket pair as read port 2065 and write port 2067; DLSw version 2 (RFC 2166) and common vendor implementations settle on a single connection to 2065. If it is open, you are looking at a router or a legacy gateway keeping mainframe-era traffic alive, not a general-purpose server. There is no encryption and no user authentication in the protocol — peers are identified by configuration.",
  "exposure": {
    "verdict": "never",
    "note": "A cleartext, unauthenticated router-to-router tunnel into an internal SNA/NetBIOS network. Keep DLSw peers on private links or inside an IPsec tunnel."
  },
  "checkCommand": "nc -vz TARGET 2065",
  "links": [
    {
      "title": "RFC 1795 — Data Link Switching: Switch-to-Switch Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc1795.html",
      "kind": "spec"
    },
    {
      "title": "RFC 2166 — DLSw version 2 Enhancements",
      "url": "https://www.rfc-editor.org/rfc/rfc2166.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}