NetWare Core Protocol — a Novell NetWare or eDirectory server, or something that inherited its stack.
IANA registers 524 on both TCP and UDP as "ncp", the NetWare Core Protocol, which Novell used for file, print, and directory access. When NetWare moved off IPX to native IP, NCP settled on TCP 524, and the port carried forward into Novell/Micro Focus eDirectory servers where it is used for directory operations alongside LDAP. Outside of surviving eDirectory deployments you will effectively never see this on a modern scan.
Do not expose
A directory and file-service control port for a legacy stack that no longer receives broad security attention — keep it on an internal segment.
$ nc -vz -w 3 TARGET 524Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.