{
  "port": 3372,
  "protocol": "both",
  "service": "MSDTC / TIP 2",
  "oneLiner": "The TIP listener of Microsoft's Distributed Transaction Coordinator — a Windows transaction plane, not an application port.",
  "whatItIs": "IANA registers 3372 as tip2 (Transaction Internet Protocol), and Microsoft's MSDTC service listens there for its TIP transaction-manager facet, which lets a Windows transaction coordinator interoperate with non-Microsoft transaction managers. You will see it on SQL Server boxes, BizTalk hosts, and COM+ application servers where distributed transactions are enabled; MSDTC's main OleTx traffic still goes through the RPC endpoint mapper on 135 plus a dynamic port. A configuration flag controls whether the TIP facet will accept a connection from a source port other than 3372.",
  "exposure": {
    "verdict": "never",
    "note": "This is a transaction-control plane between trusted servers, historically a DoS target, and it pairs with RPC on 135 — keep it on an internal segment behind a firewall rule that names the specific peer hosts."
  },
  "checkCommand": "nc -vz -w 3 TARGET 3372",
  "links": [
    {
      "title": "[MS-DTCM]: MSDTC Connection Manager — OleTx Transaction Internet Protocol",
      "url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtcm/afe8d1f8-880e-4c03-a303-cec26e5d148d",
      "kind": "spec"
    },
    {
      "title": "Configure Distributed Transaction Coordinator (DTC) to work through a firewall",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/application-management/configure-dtc-to-work-through-firewalls",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 3372 (tip2)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3372",
      "kind": "iana"
    }
  ]
}