{
  "port": 3527,
  "protocol": "both",
  "service": "beserver-msg-q (Backup Exec Server)",
  "oneLiner": "The Backup Exec Server service's message-queue port — a backup control plane.",
  "whatItIs": "IANA assigned 3527 in 2002 to Veritas for the Backup Exec Server message queue, and the Backup Exec Server service still requires it: the port must be open in both directions between a central administration server and its managed backup servers, and if another application has taken 3527 the Backup Exec Server service will not start. You will find it on Windows backup servers alongside the Agent for Windows on 10000. It is a Windows-only, product-specific port with no public wire specification.",
  "exposure": {
    "verdict": "never",
    "note": "A backup infrastructure's control channel reaches every protected system and the copies of their data — restrict it to named backup hosts on an internal segment."
  },
  "checkCommand": "nc -vz -w 3 TARGET 3527",
  "links": [
    {
      "title": "IANA port registry — 3527 (beserver-msg-q)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3527",
      "kind": "iana"
    }
  ]
}