{
  "port": 5903,
  "protocol": "tcp",
  "service": "ff-ice (ICAO) / VNC display :3 in practice",
  "oneLiner": "Registered to ICAO for flight-information exchange, but on a live host it is VNC display :3.",
  "whatItIs": "IANA assigns 5903 to ff-ice, \"Flight & Flow Info for Collaborative Env\", one of a block of ports the International Civil Aviation Organisation registered for aeronautical data services over TCP, UDP, and SCTP. Those systems run on private aviation networks, not on the internet, so you will not meet them on an ordinary scan. What you will meet is VNC: 5900 plus display 3, a third simultaneous remote desktop or hypervisor console on the host.",
  "exposure": {
    "verdict": "never",
    "note": "If it is VNC, it inherits the unencrypted, weakly authenticated RFB session and should stay on the loopback. If it genuinely is an ICAO service, it belongs on a private aeronautical network by definition."
  },
  "checkCommand": "nc -w 3 TARGET 5903 | head -c 12; echo",
  "links": [
    {
      "title": "IANA port registry — 5903 (ff-ice)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5903",
      "kind": "iana"
    },
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    }
  ]
}