{
  "port": 5998,
  "protocol": "tcp",
  "service": "Unassigned (historically NCD X terminal diagnostics)",
  "oneLiner": "Unassigned by IANA; historically the diagnostic telnet port of Network Computing Devices X terminals.",
  "whatItIs": "IANA lists 5995-5998 as Unassigned, so there is no current owner. The name that persists in scanner databases is `ncd-diag` — nmap still labels 5997/5998/5999 as the preferences, diagnostic and configuration telnet ports of Network Computing Devices X terminals, thin clients from the late 1980s and 1990s. That hardware is long gone, so a listener today is an unrelated application that picked a free port just below 6000.",
  "exposure": {
    "verdict": "careful",
    "note": "No registered service means the port number tells you nothing — identify the process locally before allowing any access. If it genuinely is a telnet-style diagnostic console, treat it as never."
  },
  "checkCommand": "nmap -Pn -sV -p 5998 TARGET",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services — the port-frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}