{
  "port": 4001,
  "protocol": "tcp",
  "service": "IPFS swarm; legacy etcd client API (IANA: NewOak)",
  "oneLiner": "IPFS peer-to-peer swarm traffic, and the legacy client port of etcd v2 — two very different things behind one number.",
  "whatItIs": "IANA registers 4001 as newoak, which is dead. In practice 4001 has two live meanings. IPFS (Kubo) uses it as the default swarm port for peer-to-peer connections over TCP and QUIC, and its documentation recommends 4001 when you are unsure what to open. Separately, etcd's v2-era default listened for clients on both 2379 and the legacy 4001, and old Kubernetes and CoreOS tooling still references it. Which one you have changes the answer completely, so identify the process before you decide anything.",
  "exposure": {
    "verdict": "careful",
    "note": "An IPFS swarm port is meant to be reachable and is fine to open. A legacy etcd client port is the opposite: it is the cluster's key-value store, historically served over plain HTTP with no authentication, and must never be exposed."
  },
  "checkCommand": "sudo lsof -nP -iTCP:4001 -sTCP:LISTEN",
  "links": [
    {
      "title": "IPFS docs — NAT configuration (4001 is the recommended swarm port)",
      "url": "https://docs.ipfs.tech/how-to/nat-configuration/",
      "kind": "official-docs"
    },
    {
      "title": "etcd v2.3 configuration flags (listen-client-urls includes 4001)",
      "url": "https://etcd.io/docs/v2.3/configuration/",
      "kind": "official-docs"
    },
    {
      "title": "ipfs/kubo on GitHub",
      "url": "https://github.com/ipfs/kubo",
      "kind": "github"
    },
    {
      "title": "IANA port registry — 4001 (newoak)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4001",
      "kind": "iana"
    }
  ],
  "ianaName": "newoak"
}