Registered as rrac, but on a modern host an open 5678 is almost always n8n's editor and webhook listener.
IANA assigns 5678 to rrac, "Remote Replication Agent Connection", a name you will effectively never meet in the wild. What actually listens there today is n8n, the self-hosted workflow-automation server: N8N_PORT defaults to 5678 and the official Docker image publishes it. That one port serves both the editor UI and the webhook URLs that fire workflows, so it is simultaneously an admin console and a public-facing trigger surface. On a container host, 5678 is n8n until proven otherwise.
Do not expose
The n8n editor runs arbitrary code and holds stored credentials for every service it integrates with, and it speaks plain HTTP. Put it behind a reverse proxy with TLS and authentication rather than on a public IP.
$ curl -sS -o /dev/null -w '%{http_code}\n' http://TARGET:5678/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.