{
  "port": 6346,
  "protocol": "both",
  "service": "Gnutella",
  "oneLiner": "The Gnutella peer-to-peer network's default port, TCP and UDP 6346.",
  "whatItIs": "IANA registers 6346 as gnutella-svc for both TCP and UDP, and it is the default listening port for Gnutella servents — historically LimeWire, BearShare and Shareaza, still gtk-gnutella today. TCP carries peer connections and file transfers; UDP carries out-of-band query replies and host-cache pings in the modern protocol. Because peers must accept inbound connections to be useful, this port is deliberately opened or UPnP-forwarded, and it lit up firewall logs constantly during the file-sharing era. Finding it on a corporate network is normally a policy question about P2P clients rather than a compromise.",
  "exposure": {
    "verdict": "careful",
    "note": "Gnutella is designed to be internet-facing — an unreachable peer is a degraded peer — so exposing it can be deliberate. The exposure is what the client shares and the fact that an open 6346 advertises this host as a P2P node: audit the shared folders, and expose it only where that is fine."
  },
  "checkCommand": "sudo lsof -nP -iTCP:6346 -sTCP:LISTEN",
  "links": [
    {
      "title": "gtk-gnutella on GitHub",
      "url": "https://github.com/gtk-gnutella/gtk-gnutella",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6346 (gnutella-svc)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6346",
      "kind": "iana"
    }
  ]
}