{
  "port": 4567,
  "protocol": "tcp",
  "service": "Sinatra dev server / Galera replication (IANA: tram)",
  "oneLiner": "Two very different things: a Ruby Sinatra app in development, or a Galera cluster's replication channel.",
  "whatItIs": "IANA's name for 4567 is TRAM, which you will not meet. In practice it is one of two things. Ruby's Sinatra framework starts its built-in server on 4567, so a plain HTTP response here is usually someone's development app. Alternatively, MariaDB Galera and Percona XtraDB Cluster use 4567 for gcomm group communication — the replication channel between cluster nodes — with 4568 for incremental state transfer and 4444 for full snapshot transfer. An HTTP request distinguishes them in one shot.",
  "exposure": {
    "verdict": "never",
    "note": "A Sinatra dev server runs with development error pages and no hardening; Galera group communication is unencrypted database replication unless TLS is explicitly configured. Neither belongs on a public interface."
  },
  "checkCommand": "curl -sI --max-time 5 http://TARGET:4567/",
  "links": [
    {
      "title": "sinatra/sinatra — default port 4567",
      "url": "https://github.com/sinatra/sinatra",
      "kind": "github"
    },
    {
      "title": "MariaDB — Galera cluster address (replication defaults to 4567)",
      "url": "https://mariadb.com/docs/galera-cluster/galera-management/configuration/galera-cluster-address",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 4567 (tram)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=4567",
      "kind": "iana"
    }
  ]
}