{
  "port": 2106,
  "protocol": "both",
  "service": "MZAP / ekshell",
  "oneLiner": "MZAP's multicast scope announcements on UDP; historically Kerberos encrypted rshell on TCP.",
  "whatItIs": "RFC 2776 defines the Multicast-Scope Zone Announcement Protocol here: routers on a scope boundary send Zone Announcement Messages to UDP 2106 at the local-scope group 239.255.255.252 so hosts can discover administrative scope zones and operators can spot misconfigured boundaries. That traffic is multicast infrastructure, not something a host offers. Unix /etc/services and Nmap also list ekshell on TCP 2106, the encrypted Kerberos remote-shell counterpart to eklogin, which MIT moved out of krb5 along with the rest of the Kerberized applications.",
  "exposure": {
    "verdict": "careful",
    "note": "MZAP is scoped multicast that is not meant to cross a zone boundary at all. A TCP listener here is something else — historically a Kerberized rshell daemon — and should be identified and kept internal."
  },
  "checkCommand": "sudo tcpdump -ni any udp port 2106",
  "links": [
    {
      "title": "RFC 2776 — Multicast-Scope Zone Announcement Protocol (MZAP)",
      "url": "https://www.rfc-editor.org/rfc/rfc2776.html",
      "kind": "spec"
    },
    {
      "title": "krb5-appl — the Kerberized telnet/rlogin/ftp applications split out of MIT krb5",
      "url": "https://github.com/krb5/krb5-appl",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}