{
  "port": 902,
  "protocol": "tcp",
  "service": "VMware host agent / vmware-authd",
  "oneLiner": "In practice this is an ESXi host or a VMware Workstation install; IANA's registration (ideafarm-door) has nothing to do with it.",
  "whatItIs": "VMware's authentication daemon and host agent listen on TCP 902 for core management traffic between vCenter Server and an ESXi host, for NFC (Network File Copy) used in provisioning, cloning and cold migration, and for the MKS channel that carries a virtual machine's mouse, keyboard and screen to a remote console. ESXi also sends a heartbeat to vCenter on UDP 902. Broadcom's documentation states the MKS port is not configurable, which is why 902 is one of the most reliable ways to identify an ESXi host on a scan. It answers with a plaintext banner naming the VMware Authentication Daemon and its version before requiring SSL.",
  "exposure": {
    "verdict": "never",
    "note": "This is a hypervisor management and console plane — anything that can reach it is one credential away from the screen and keyboard of every VM on the host. It belongs on an isolated management network."
  },
  "checkCommand": "nc -v -w 3 TARGET 902",
  "links": [
    {
      "title": "Broadcom — Port requirements for VMware vSphere ESXi",
      "url": "https://knowledge.broadcom.com/external/article/318895/port-requirements-for-vmware-vsphere-esx.html",
      "kind": "official-docs"
    },
    {
      "title": "Broadcom TechDocs — Connecting to the Virtual Machine Console Through a Firewall",
      "url": "https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/7-0/vsphere-security/securing-vsphere-networking/securing-the-network-with-firewalls/connecting-to-the-virtual-machine-console-through-a-firewall.html",
      "kind": "official-docs"
    },
    {
      "title": "IANA port registry — 902",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=902",
      "kind": "iana"
    }
  ],
  "ianaName": "ideafarm-door"
}