{
  "port": 8648,
  "protocol": "tcp",
  "service": "Unassigned",
  "oneLiner": "Unregistered, and one below Ganglia's 8649 — which is the only reason it gets noticed.",
  "whatItIs": "IANA has no assignment for 8648. Its neighbour 8649 is the Ganglia monitoring daemon's default port, and Ganglia deployments often spread extra channels across nearby numbers, but nothing documents 8648 specifically as a default. Nmap lists it as \"unknown\" at roughly 0.015% open. Read a listener here as an unidentified service that happens to sit next to a known one.",
  "exposure": {
    "verdict": "careful",
    "note": "Do not infer Ganglia from adjacency. Identify the process, and if it does turn out to be a monitoring channel, keep it internal."
  },
  "checkCommand": "sudo lsof -nP -iTCP:8648 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    },
    {
      "title": "nmap-services — Nmap port frequency data",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}