{
  "port": 5633,
  "protocol": "both",
  "service": "Backup Exec Operations Request Listener (beorl)",
  "oneLiner": "A Veritas Backup Exec server listening for DBA-initiated Oracle and DB2 backup jobs.",
  "whatItIs": "IANA registered 5633 in 2006 as beorl, the BE Operations Request Listener, part of Symantec's — now Veritas' — Backup Exec. The media server opens it so database administrators can start Oracle and DB2 backups from the database host rather than from the backup console. On a scan it identifies the machine as a backup server, which is exactly the machine an attacker wants.",
  "exposure": {
    "verdict": "never",
    "note": "Backup infrastructure holds copies of everything; the listener belongs on the internal backup network, reachable only from the database hosts that need it."
  },
  "checkCommand": "nc -vz -w 3 TARGET 5633",
  "links": [
    {
      "title": "IANA port registry — 5633 (beorl)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5633",
      "kind": "iana"
    }
  ]
}