{
  "port": 32773,
  "protocol": "both",
  "service": "filenet-cm (IANA) / dynamic ONC RPC",
  "oneLiner": "Registered to FileNET Component Manager; in the wild it is a dynamically assigned ONC RPC program, not that product.",
  "whatItIs": "IANA assigns 32773 to FileNET Component Manager, part of the FileNet block spanning 32768–32777, and that product is rarely what you find. Historically this range is where Solaris and other System V hosts handed out ports to ONC RPC programs that registered with rpcbind, which is why Nmap names the port sometimes-rpc9. Nmap's comment records it as an RPC port on Solaris, most often rquotad. On Linux the same number falls inside the default ephemeral range (32768–60999), so it can equally be a container publish or an outbound socket. The only way to know is to ask rpcbind or fingerprint the listener.",
  "exposure": {
    "verdict": "careful",
    "note": "Legacy ONC RPC services here (statd, rusersd, rquotad, sprayd, walld) authenticate weakly or not at all and have a long CVE history; keep them off the internet and reachable only from trusted NFS clients."
  },
  "checkCommand": "rpcinfo -p TARGET",
  "links": [
    {
      "title": "IANA port registry — 32773 (filenet-cm)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=32773",
      "kind": "iana"
    },
    {
      "title": "RFC 1833 — Binding Protocols for ONC RPC Version 2",
      "url": "https://www.rfc-editor.org/rfc/rfc1833.html",
      "kind": "spec"
    },
    {
      "title": "rpcbind(8) manual page",
      "url": "https://man7.org/linux/man-pages/man8/rpcbind.8.html",
      "kind": "official-docs"
    },
    {
      "title": "nmap-services — Nmap's port frequency and name table",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}