{
  "port": 32770,
  "protocol": "both",
  "service": "filenet-nch (IANA) / dynamic ONC RPC",
  "oneLiner": "Registered to FileNet NCH; in the wild it is a dynamically assigned ONC RPC program, not that product.",
  "whatItIs": "IANA assigns 32770 to FileNet NCH, part of the FileNet block spanning 32768–32777, and that product is rarely what you find. Historically this range is where Solaris and other System V hosts handed out ports to ONC RPC programs that registered with rpcbind, which is why Nmap names the port sometimes-rpc3. Nmap's own comment for it is \"Sometimes an RPC port on my Solaris box\" — no specific program named. On Linux the same number falls inside the default ephemeral range (32768–60999), so it can equally be a container publish or an outbound socket. The only way to know is to ask rpcbind or fingerprint the listener.",
  "exposure": {
    "verdict": "careful",
    "note": "Legacy ONC RPC services here (statd, rusersd, rquotad, sprayd, walld) authenticate weakly or not at all and have a long CVE history; keep them off the internet and reachable only from trusted NFS clients."
  },
  "checkCommand": "rpcinfo -p TARGET",
  "links": [
    {
      "title": "IANA port registry — 32770 (filenet-nch)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=32770",
      "kind": "iana"
    },
    {
      "title": "RFC 1833 — Binding Protocols for ONC RPC Version 2",
      "url": "https://www.rfc-editor.org/rfc/rfc1833.html",
      "kind": "spec"
    },
    {
      "title": "rpcbind(8) manual page",
      "url": "https://man7.org/linux/man-pages/man8/rpcbind.8.html",
      "kind": "official-docs"
    },
    {
      "title": "nmap-services — Nmap's port frequency and name table",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}