{
  "port": 5120,
  "protocol": "both",
  "service": "Barracuda Backup replication",
  "oneLiner": "Barracuda Backup's offsite replication port — outbound from the appliance, never inbound.",
  "whatItIs": "IANA registers 5120 as barracuda-bbs, the Barracuda Backup Protocol. Barracuda's documentation puts 5120-5129 in the outbound set a Backup appliance needs, using them to replicate data to Barracuda Cloud Storage or to a second Barracuda Backup device. The vendor is explicit that no inbound ports are required: the appliance always initiates the connection, and these ports cannot be proxied.",
  "exposure": {
    "verdict": "careful",
    "note": "Allow it outbound from the backup appliance only. There is no reason for an inbound firewall rule on 5120, so a listener answering from the internet is not a normal Barracuda deployment."
  },
  "checkCommand": "nc -vz TARGET 5120",
  "links": [
    {
      "title": "Barracuda Backup — Port Usage",
      "url": "https://documentation.campus.barracuda.com/wiki/display/BBSv42/Port+Usage",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5120 (barracuda-bbs)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5120",
      "kind": "iana"
    }
  ]
}