{
  "port": 8400,
  "protocol": "tcp",
  "service": "Commvault CVD",
  "oneLiner": "Commvault's core communications service — the backup platform's control channel.",
  "whatItIs": "IANA registers the bare name cvd on 8400 with no description, and the software behind it is Commvault: its firewall documentation lists \"TCP 8400 — CVD services\" as required between the CommServe, MediaAgents and clients, with 8401 (Server Event Manager) and 8402/8403/8405 alongside it. Every Commvault-managed machine runs the CVD service, so on an enterprise network 8400 usually marks a backup client or media agent. Outside that product the port is rare — Nmap sees it open on about 0.04% of hosts.",
  "exposure": {
    "verdict": "never",
    "note": "This is the control channel of a backup platform that holds copies of everything. Keep it inside the backup network or behind Commvault's own network-gateway/tunnel configuration, never on a public interface."
  },
  "checkCommand": "sudo lsof -nP -iTCP:8400 -sTCP:LISTEN",
  "links": [
    {
      "title": "Commvault — Firewall port requirements",
      "url": "https://documentation.commvault.com/11.41/software/firewall_port_requirements.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}