{
  "port": 9002,
  "protocol": "tcp",
  "service": "DynamID authentication (registered)",
  "oneLiner": "Registered as dynamid; in practice just the port after 9001 that an app happened to take.",
  "whatItIs": "IANA registers 9002 tcp and udp as dynamid, \"DynamID authentication\". That product has no meaningful presence today, so the registration does not predict what you will find. What 9002 actually hosts is usually the second port of some multi-port application — a sidecar, a metrics endpoint, or a second instance of whatever runs on 9000 or 9001 on the same host.",
  "exposure": {
    "verdict": "careful",
    "note": "Check what owns it, and check its neighbours: a service on 9000/9001 often explains 9002, and inherits that service's exposure rules."
  },
  "checkCommand": "sudo lsof -nP -iTCP:9002 -sTCP:LISTEN",
  "links": [
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 9002",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9002",
      "kind": "iana"
    }
  ],
  "ianaName": "dynamid"
}