{
  "port": 5500,
  "protocol": "tcp",
  "service": "VNC listening viewer (IANA: fcp-addr-srvr1)",
  "oneLiner": "Usually a VNC viewer in listening mode, waiting for a remote desktop to connect back to it.",
  "whatItIs": "IANA registers 5500 as fcp-addr-srvr1, a name you will essentially never meet. The real-world use is reverse VNC: run vncviewer -listen and the viewer listens on 5500 so a server behind NAT can dial out to the support technician instead of the other way round. That inverts the usual direction of 5900, which is why 5500 shows up on helpdesk workstations rather than on servers. Legacy RSA ACE/Server installations also used UDP 5500 for authentication requests, per their shipped services file.",
  "exposure": {
    "verdict": "never",
    "note": "A listening VNC viewer accepts an inbound desktop session from anyone who reaches it, and classic RFB gives you no transport encryption — restrict it to a VPN or an SSH tunnel."
  },
  "checkCommand": "sudo lsof -nP -iTCP:5500 -sTCP:LISTEN",
  "links": [
    {
      "title": "TigerVNC — vncviewer(1), listening mode on port 5500",
      "url": "https://tigervnc.org/doc/vncviewer.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 5500 (fcp-addr-srvr1)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5500",
      "kind": "iana"
    }
  ]
}