{
  "port": 514,
  "protocol": "both",
  "service": "rsh (TCP) / syslog (UDP)",
  "oneLiner": "Two unrelated services share this number: BSD rsh on TCP, and syslog on UDP.",
  "whatItIs": "IANA registers TCP 514 as \"shell\" — the BSD rsh service, which runs a single command remotely using the same host-based .rhosts trust as rlogin, and which also opens a second connection back to the client for stderr. UDP 514 is syslog, the log-shipping protocol (RFC 5424 format, RFC 5426 UDP transport), and that is what almost every hit on 514 is today: routers, firewalls, and servers forwarding log lines to a collector. Syslog over TCP has no assigned port at all; RFC 6587 notes that implementations commonly borrow TCP/514 anyway, which is exactly why a TCP listener here is as likely to be a log collector as an rsh daemon.",
  "exposure": {
    "verdict": "never",
    "note": "rsh is cleartext remote command execution with address-based trust. Plain syslog is unauthenticated and unencrypted, so an exposed collector can be flooded with forged log entries and, over UDP, used for spoofed traffic — send logs over TLS (RFC 5425) or a private network instead."
  },
  "checkCommand": "nmap -Pn -sV -p 514 TARGET",
  "links": [
    {
      "title": "RFC 5424 — The Syslog Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc5424.html",
      "kind": "spec"
    },
    {
      "title": "RFC 6587 — Transmission of Syslog Messages over TCP (on the unassigned TCP/514 habit)",
      "url": "https://www.rfc-editor.org/rfc/rfc6587.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 514",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=514",
      "kind": "iana"
    }
  ]
}