# WHATPORT(3221)

## NAME

port 3221 — Junos XML protocol, cleartext (xnm-clear-text) — Juniper's XML management protocol in the clear — full device configuration over an unencrypted socket.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 3221 as `xnm-clear-text`, "XML NM over TCP", and that is exactly Juniper's use: configuring `set system services xnm-clear-text` makes a Junos device accept Junos XML protocol (JUNOScript) sessions on TCP 3221 with no transport encryption, while the TLS variant `xnm-ssl` lives on 3220. A client logs in with a device account and can then read and change the entire configuration in XML. Juniper's documentation offers connection-limit and rate-limit knobs, and notes the statement is unavailable on Junos-FIPS and discouraged in Common Criteria environments. An open 3221 means a router or switch is taking management sessions in cleartext.

## EXPOSURE

**Do not expose.** Credentials and the full device configuration cross the wire unencrypted; use NETCONF over SSH (830) or xnm-ssl instead, and never expose either off the management network.

## CHECK

```sh
nc -v TARGET 3221
```

## SEE ALSO

- docs — [Juniper — xnm-clear-text (edit system services)](https://www.juniper.net/documentation/us/en/software/junos/cli-reference/topics/ref/statement/xnm-clear-text-edit-system.html) (juniper.net)
- docs — [Juniper — Configure clear-text or SSL Service for Junos XML Protocol Client Applications](https://www.juniper.net/documentation/us/en/software/junos/junos-xml-protocol/topics/task/remote-access-junoscript-client-applications-clear-text-ssl.html) (juniper.net)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/3221/> · JSON: <https://whatport.net/3221.json> · full dataset: <https://whatport.net/ports.json>