{
  "port": 32768,
  "protocol": "both",
  "service": "filenet-tms (IANA) / first ephemeral port on Linux",
  "oneLiner": "IANA says FileNet TMS; Linux says this is where the ephemeral port range starts.",
  "whatItIs": "IANA registers 32768 to FileNet TMS, part of an IBM FileNet block running from 32768 to 32777, and that software is rare. The far more common reason the port is busy is that 32768 is the bottom of the Linux default ephemeral range — the kernel documents ip_local_port_range as 32768 to 60999 — so it is the first port the kernel hands to an outbound socket, a `docker run -P` publish, or any program that asked for port 0. Solaris historically started its RPC dynamic range here too. A listener on 32768 is therefore usually anonymous rather than FileNet.",
  "exposure": {
    "verdict": "careful",
    "note": "Whatever bound this asked the OS for \"any free port\", which means nobody chose to publish it — identify the process before allowing it through a firewall."
  },
  "checkCommand": "sudo lsof -nP -iTCP:32768 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA port registry — 32768 (filenet-tms)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=32768",
      "kind": "iana"
    },
    {
      "title": "Linux kernel documentation — ip-sysctl (ip_local_port_range)",
      "url": "https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html",
      "kind": "official-docs"
    }
  ]
}