{
  "port": 3211,
  "protocol": "tcp",
  "service": "Avocent Secure Management",
  "oneLiner": "Avocent's management channel for KVM-over-IP and serial console appliances.",
  "whatItIs": "IANA registers 3211 as `avsecuremgmt`, \"Avocent Secure Management\", registered by Avocent, the KVM-over-IP and serial console vendor. The registration is the whole of the public record: there is no published protocol description and no vendor port list that documents the number, so what it carries is unverified. If it is genuinely an Avocent appliance answering, it sits on a data-centre out-of-band network alongside the appliance's web UI and KVM ports — confirm by identifying the device rather than by the registry name.",
  "exposure": {
    "verdict": "never",
    "note": "A port registered to out-of-band console hardware, which is the keys to every attached machine, and appliance firmware ages badly — keep it on an isolated management network and identify the device before allowing any inbound access."
  },
  "checkCommand": "nc -vz TARGET 3211",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}