{
  "port": 6566,
  "protocol": "tcp",
  "service": "SANE (saned)",
  "oneLiner": "SANE's network scanner daemon — remote access to a scanner, in cleartext.",
  "whatItIs": "IANA registered 6566 as sane-port, the SANE Control Port, in 2002. saned is the daemon from the SANE project that lets other machines drive a locally attached scanner over the network; a client connects, names a backend and device, and pulls image data back. Access control is by host list plus an optional user list, and the protocol itself is unencrypted. You see it on Linux print/scan servers and on multifunction-device host machines.",
  "exposure": {
    "verdict": "never",
    "note": "Cleartext protocol with host-list access control and a long history of parsing bugs in the backends it fronts. Keep it on a trusted LAN segment, never on a public IP."
  },
  "checkCommand": "nc -vz TARGET 6566",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6566 (sane-port)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6566",
      "kind": "iana"
    },
    {
      "title": "SANE Project — backends source repository",
      "url": "https://gitlab.com/sane-project/backends",
      "kind": "official-docs"
    }
  ]
}