{
  "port": 8649,
  "protocol": "both",
  "service": "Ganglia gmond",
  "oneLiner": "Ganglia's node monitoring daemon — UDP for the metric channel, TCP to dump cluster state as XML.",
  "whatItIs": "gmond, the Ganglia monitoring daemon, defaults to 8649 on both transports: a udp_recv_channel (usually multicast) collects metrics from other nodes, and a tcp_accept_channel serves the accumulated cluster state as XML to anything that connects. Both defaults are 8649 in the shipped configuration documentation. The port has no IANA assignment; it is a convention of the Ganglia project, common on HPC clusters and older Linux fleets. Connecting to it with netcat returns the full XML inventory with no authentication.",
  "exposure": {
    "verdict": "never",
    "note": "An open TCP 8649 hands out hostnames, OS versions, load, and the shape of your whole cluster to anyone who connects. Ganglia's only control is an optional ACL — keep it on the management network."
  },
  "checkCommand": "nc TARGET 8649 | head -40",
  "links": [
    {
      "title": "Ganglia gmond configuration reference (conf.pod)",
      "url": "https://github.com/ganglia/monitor-core/blob/master/gmond/conf.pod",
      "kind": "github"
    },
    {
      "title": "Ganglia monitor-core source repository",
      "url": "https://github.com/ganglia/monitor-core",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}