{
  "port": 2103,
  "protocol": "tcp",
  "service": "Zephyr serv-hm / MSMQ RPC",
  "oneLiner": "Registered to MIT's Zephyr notification service; on Windows hosts it is Microsoft Message Queuing's RPC port.",
  "whatItIs": "IANA and /etc/services name 2103 zephyr-clt, the server-to-hostmanager link in MIT Project Athena's Zephyr messaging system, which sits between zephyr-srv on 2102 and zephyr-hm on 2104. In modern scanning the port almost always means something else: MSMQ independent clients and servers listen on 2103 (with 2105) for RPC-based remote reads of public and private queues, after the client asks the endpoint mapper on 135 which ports to use. That is why 2103 shows up far more often than its neighbours — it is a Windows host with Message Queuing installed.",
  "exposure": {
    "verdict": "never",
    "note": "An MSMQ RPC endpoint exposes queue contents to whoever can authenticate, and RPC services on 135/2103/2105 are a standing target. Keep Message Queuing inside the network."
  },
  "checkCommand": "nc -vz TARGET 2103",
  "links": [
    {
      "title": "Microsoft — ports used by MSMQ (1801, 135, 2103/2105, 2107, 3527)",
      "url": "https://learn.microsoft.com/en-us/archive/blogs/johnbreakwell/clear-the-way-msmq-coming-through",
      "kind": "official-docs"
    },
    {
      "title": "Zephyr notification system (MIT Project Athena)",
      "url": "https://github.com/zephyr-im/zephyr",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}