{
  "port": 32769,
  "protocol": "both",
  "service": "filenet-rpc (IANA) / ephemeral or RPC service",
  "oneLiner": "Registered to FileNet RPC, in practice the second port out of the Linux ephemeral pool.",
  "whatItIs": "IANA lists 32769 as filenet-rpc for IBM FileNet, one of the 32768–32777 block, and deployments of it are uncommon. Sitting one above the start of the Linux ephemeral range (32768–60999), it is far more often a socket that asked for any free port — an outbound connection, a container port publish, or a dynamically bound RPC program registered with rpcbind. Nmap sees it as a low-frequency open port with no reliable fingerprint.",
  "exposure": {
    "verdict": "careful",
    "note": "Treat as an unidentified dynamically assigned service; ask rpcbind or the host's own socket table what it is before exposing it."
  },
  "checkCommand": "rpcinfo -p TARGET",
  "links": [
    {
      "title": "IANA port registry — 32769 (filenet-rpc)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=32769",
      "kind": "iana"
    },
    {
      "title": "Linux kernel documentation — ip-sysctl (ip_local_port_range)",
      "url": "https://www.kernel.org/doc/html/latest/networking/ip-sysctl.html",
      "kind": "official-docs"
    },
    {
      "title": "rpcbind(8) manual page",
      "url": "https://man7.org/linux/man-pages/man8/rpcbind.8.html",
      "kind": "official-docs"
    }
  ]
}