{
  "port": 5904,
  "protocol": "tcp",
  "service": "ag-swim (ICAO) / VNC display :4 in practice",
  "oneLiner": "IANA calls it Air-Ground SWIM; in the field it is VNC display :4.",
  "whatItIs": "The registered service on 5904 is ag-swim, \"Air-Ground SWIM\", part of ICAO's block of aeronautical registrations (5903 through 5914) for System Wide Information Management traffic between aircraft and ground systems. Those run on dedicated aviation networks. On a general-purpose host, 5904 is 5900 plus display 4 — a fourth VNC desktop or VM console, common on hypervisors that allocate one console port per running guest.",
  "exposure": {
    "verdict": "never",
    "note": "Hypervisor VNC consoles hand whoever connects a keyboard and screen attached to the guest, often with no password at all. Restrict them to the management network."
  },
  "checkCommand": "nc -w 3 TARGET 5904 | head -c 12; echo",
  "links": [
    {
      "title": "IANA port registry — 5904 (ag-swim)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5904",
      "kind": "iana"
    },
    {
      "title": "RFC 6143 — The Remote Framebuffer Protocol",
      "url": "https://datatracker.ietf.org/doc/html/rfc6143",
      "kind": "spec"
    }
  ]
}