Symantec pcAnywhere's remote-control data channel — on a modern network, a stranded legacy host.
5631/tcp carries the session data for Symantec pcAnywhere remote control, paired with 5632/udp, which answers host discovery broadcasts and is how scanners enumerate pcAnywhere hosts. Symantec discontinued the product after its source code leaked in 2012, and at the time advised customers to disable it until patched. Anything still answering here is an unmaintained remote-control host, typically on an old Windows server or an industrial machine nobody has touched in years.
Do not expose
Discontinued, unpatched remote-desktop software with a history of weak authentication — an internet-facing 5631 is a standing invitation.
$ nc -vz -w 3 TARGET 5631Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.