{
  "port": 3784,
  "protocol": "both",
  "service": "BFD Control",
  "oneLiner": "Bidirectional Forwarding Detection control packets — the sub-second liveness check between routers.",
  "whatItIs": "BFD gives routing protocols a fast, protocol-independent way to notice that a neighbour has gone away, exchanging small control packets on a timer measured in milliseconds. RFC 5881 defines single-hop BFD over IPv4 and IPv6 with destination UDP port 3784; the source port comes from the 49152-65535 range, and receivers are required to check that the packet arrived with TTL/hop-limit 255. IANA also lists a TCP registration for the number, but the protocol only ever uses UDP. You will find it configured alongside BGP, OSPF, or static routes on routers, switches, and firewalls.",
  "exposure": {
    "verdict": "never",
    "note": "It is a routing control plane: spoofed or flooded BFD packets can tear down adjacencies. RFC 5881's TTL=255 check and BFD authentication exist precisely because this must stay between directly connected, trusted peers."
  },
  "checkCommand": "sudo tcpdump -ni any udp port 3784",
  "links": [
    {
      "title": "RFC 5881 — BFD for IPv4 and IPv6 (Single Hop)",
      "url": "https://www.rfc-editor.org/rfc/rfc5881.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 3784 (bfd-control)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=3784",
      "kind": "iana"
    }
  ]
}