{
  "port": 7937,
  "protocol": "tcp",
  "service": "NetWorker nsrexecd",
  "oneLiner": "The backup agent daemon for Legato/EMC/Dell NetWorker — the entry point to a backup client.",
  "whatItIs": "IANA leaves 7937 unassigned, but in the field it is nsrexecd, the client-side execution service of NetWorker (originally Legato, then EMC, now Dell). Every protected host runs it so the backup server can start save and recover jobs remotely, and it anchors NetWorker's service port range. Nmap names it `nsrexecd` and it is one of the more commonly seen ports in the 7900s on enterprise networks. Finding it means you found a backup client, and by extension a backup server that talks to it.",
  "exposure": {
    "verdict": "never",
    "note": "This is a remote job-execution daemon wired into a backup fabric that can read every file on the host. It belongs on a segmented backup network, never on anything internet-facing."
  },
  "checkCommand": "nmap -sV -Pn -p 7937 TARGET",
  "links": [
    {
      "title": "nmap/nmap — nmap-services (7937/tcp nsrexecd, Legato NetWorker)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 7937",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=7937",
      "kind": "iana"
    }
  ]
}