Juniper's XML management protocol in the clear — full device configuration over an unencrypted socket.
IANA registers 3221 as xnm-clear-text, "XML NM over TCP", and that is exactly Juniper's use: configuring set system services xnm-clear-text makes a Junos device accept Junos XML protocol (JUNOScript) sessions on TCP 3221 with no transport encryption, while the TLS variant xnm-ssl lives on 3220. A client logs in with a device account and can then read and change the entire configuration in XML. Juniper's documentation offers connection-limit and rate-limit knobs, and notes the statement is unavailable on Junos-FIPS and discouraged in Common Criteria environments. An open 3221 means a router or switch is taking management sessions in cleartext.
Do not expose
Credentials and the full device configuration cross the wire unencrypted; use NETCONF over SSH (830) or xnm-ssl instead, and never expose either off the management network.
$ nc -v TARGET 3221Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.