{
  "port": 2111,
  "protocol": "tcp",
  "service": "kx (X over Kerberos) / OPNET DSATP",
  "oneLiner": "IANA registers OPNET's Dynamic Sampling Agent protocol; Unix /etc/services calls it kx, X over Kerberos.",
  "whatItIs": "The IANA entry for 2111 is dsatp, the OPNET Dynamic Sampling Agent Transaction Protocol, assigned to OPNET Technologies. Unix service tables and Nmap instead name it kx, \"X over Kerberos\" — the Kerberized X11 forwarding daemon that shipped with the Kerberos application suite before SSH forwarding replaced it. Neither is common: Nmap finds 2111 open on about 0.03% of hosts. If it is answering, treat it as legacy monitoring or legacy Kerberos plumbing and confirm which by looking at the process.",
  "exposure": {
    "verdict": "never",
    "note": "Both candidates are unmaintained: a monitoring agent transaction port or a Kerberized X-forwarding daemon that hands out display access. Keep it off public interfaces."
  },
  "checkCommand": "sudo lsof -nP -iTCP:2111 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services — Nmap port frequency data",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}