{
  "port": 254,
  "protocol": "tcp",
  "service": "Unassigned",
  "oneLiner": "No registered service — IANA has never assigned 254, yet scanners still probe it by habit.",
  "whatItIs": "The IANA service name and port number registry has no entry for 254 on TCP or UDP; it sits in a gap between 250 and 255 that was never handed out. Nmap's empirical service list labels it plainly \"unknown\" while still ranking it inside the default top-1000 scan set, which is why it appears in scan output at all. Anything actually listening here is a local choice by whoever configured the host, not a protocol you can infer from the number. Treat an open 254 as a prompt to fingerprint the service, never as an identification.",
  "exposure": {
    "verdict": "careful",
    "note": "An open port with no registered protocol tells you nothing about what it is — identify the listener with a service probe before deciding whether it belongs on a public IP."
  },
  "checkCommand": "nmap -sV -p 254 TARGET",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 254",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=254",
      "kind": "iana"
    },
    {
      "title": "nmap-services — the empirical port frequency list (254/tcp \"unknown\")",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}