{
  "port": 3283,
  "protocol": "both",
  "service": "Apple Remote Desktop (net-assistant)",
  "oneLiner": "Apple Remote Desktop's control and reporting channel — and a known UDP amplification source.",
  "whatItIs": "IANA registers 3283 as `net-assistant`, and Apple uses it for Remote Desktop: when \"Remote Management\" is enabled on a Mac, the ARD agent listens on TCP and UDP 3283 for commands, inventory reporting and status, with the actual screen sharing running over 5900. Apple's own port reference lists both transports. The UDP side answers small status queries with much larger replies, which made exposed Macs a usable reflection and amplification vector for DDoS attacks reported in 2019. An open 3283 means Remote Management is switched on and reachable.",
  "exposure": {
    "verdict": "never",
    "note": "It grants remote administration of the Mac and its UDP listener can be abused to attack third parties — keep Remote Management on a trusted LAN or behind a VPN, never on a public address."
  },
  "checkCommand": "nc -vz TARGET 3283",
  "links": [
    {
      "title": "Apple Support — TCP and UDP ports used by Apple software products",
      "url": "https://support.apple.com/en-us/103229",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}