{
  "port": 6881,
  "protocol": "tcp",
  "service": "BitTorrent peer",
  "oneLiner": "The classic BitTorrent peer-listening port — first in the 6881-6889 range clients try.",
  "whatItIs": "BEP 3, the BitTorrent protocol specification, describes the convention directly: \"Common behavior is for a downloader to try to listen on port 6881 and if that port is taken try 6882, then 6883, etc. and give up after 6889.\" The port carries peer-to-peer connections in the swarm, not tracker traffic, and it is an inbound listener so other peers can reach you. IANA never registered it — the whole 6869-6887 block is Unassigned — and most modern clients now randomise the port or take it from a UPnP mapping, so 6881 mainly turns up on older or default-configured clients.",
  "exposure": {
    "verdict": "careful",
    "note": "The port is meant to be reachable, and a working swarm needs it, but an open 6881 publicly advertises that this host runs BitTorrent and is routinely logged by swarm monitors. Expose it deliberately, on a host where that is fine."
  },
  "checkCommand": "nc -vz TARGET 6881",
  "links": [
    {
      "title": "BEP 3 — The BitTorrent Protocol Specification",
      "url": "https://www.bittorrent.org/beps/bep_0003.html",
      "kind": "spec"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 6881",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=6881",
      "kind": "iana"
    }
  ]
}