{
  "port": 7,
  "protocol": "both",
  "service": "Echo",
  "oneLiner": "Echo — the server sends back every byte you send it, one of the original inetd debugging services.",
  "whatItIs": "Echo is defined in RFC 862: over TCP the server returns the stream unchanged until the client closes, and over UDP it returns each datagram to its sender. It exists as a reachability and round-trip test from the era before ping and traceroute were universal, and it shipped as an inetd or xinetd built-in on classic UNIX. Modern distributions ship it disabled. Its UDP form is a documented reflection and amplification vector, because a spoofed source address gets an equal-sized reply sent to the victim.",
  "exposure": {
    "verdict": "never",
    "note": "The UDP form is a spoofable reflector documented in CISA's amplification-attack alert, and the service has no legitimate internet-facing use."
  },
  "checkCommand": "printf 'hello\\n' | nc -v TARGET 7",
  "links": [
    {
      "title": "RFC 862 — Echo Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc862.html",
      "kind": "spec"
    },
    {
      "title": "CISA Alert — UDP-Based Amplification Attacks",
      "url": "https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}