{
  "port": 65389,
  "protocol": "tcp",
  "service": "Unassigned (dynamic/private range)",
  "oneLiner": "Unregistered high port with no standard service — it shows up on scans slightly more often than its neighbours, and nobody has named what is behind it.",
  "whatItIs": "Like the rest of 49152-65535, 65389 is in the Dynamic/Private range that RFC 6335 keeps unassignable, so IANA has no entry for it. Nmap's database calls it unknown but records it open on roughly 0.076% of scanned hosts — around 269th by frequency, tied with nineteen other ports at that value, which is high for an unnamed port and suggests some product or convention puts a listener there without documenting it. No public source names the service behind it. Otherwise it behaves as any ephemeral port does: Windows and macOS/BSD pick outbound source ports from this range, so most sightings are client sockets rather than servers.",
  "exposure": {
    "verdict": "careful",
    "note": "An unidentified listener on an unregistered port is the thing to investigate, not to expose. Find the process first; the verdict belongs to whatever protocol it turns out to speak."
  },
  "checkCommand": "sudo lsof -nP -iTCP:65389 -sTCP:LISTEN",
  "links": [
    {
      "title": "RFC 6335 — IANA Procedures for Port Number Registration (Dynamic/Private range 49152-65535)",
      "url": "https://www.rfc-editor.org/rfc/rfc6335.html",
      "kind": "spec"
    },
    {
      "title": "nmap-services — Nmap's port frequency database",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    },
    {
      "title": "Nmap Network Scanning — the nmap-services port frequency data",
      "url": "https://nmap.org/book/nmap-services.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}