{
  "port": 55555,
  "protocol": "tcp",
  "service": "Unassigned — memorable repdigit, commonly hand-picked",
  "oneLiner": "The high-port equivalent of \"pick something easy to remember\" — no standard owns it.",
  "whatItIs": "55555 is unregistered: RFC 6335 puts it in the Dynamic/Private range where IANA assigns nothing. Its 0.000760 frequency in Nmap's nmap-services is at the top of the unregistered-high-port band, and the plausible reason is human: it is the number people type when they need an arbitrary port for a tunnel, a test server, or a temporary listener. The SANS ISC port database labels it \"[ICS] Foxboro/Invensys Foxboro DCS FoxAPI\", which is a real industrial-control association rather than a general-purpose one. There is no single protocol behind this number, so a banner grab tells you more than any lookup will.",
  "exposure": {
    "verdict": "never",
    "note": "Ad hoc listeners on memorable ports are the ones people forget to close, and scanners try 55555 precisely because it is memorable. If it is the Foxboro DCS interface, it is an ICS control plane and belongs on an isolated network."
  },
  "checkCommand": "sudo lsof -nP -iTCP:55555 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 6335 — Dynamic Ports (49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — search 55555 (no assignment)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=55555",
      "kind": "iana"
    },
    {
      "title": "SANS Internet Storm Center — port 55555 activity",
      "url": "https://isc.sans.edu/port.html?port=55555",
      "kind": "official-docs"
    }
  ]
}