{
  "port": 9111,
  "protocol": "tcp",
  "service": "hexxorecore (historically Dragon IDS console)",
  "oneLiner": "Registered in 2018 to a message bus called hexxorecore; older tools still label it Dragon IDS Console.",
  "whatItIs": "IANA assigned 9111 to Hexxore in July 2018 for hexxorecore, described as a multiple-purpose distributed message bus. Before that registration, nmap's services file named the port DragonIDSConsole after the Enterasys Dragon intrusion-detection console, and that older label still shows up in scan output today. Neither is common on a modern network, so treat a listener here as something to fingerprint rather than something you already know.",
  "exposure": {
    "verdict": "careful",
    "note": "An IDS management console or a message bus is an internal control-plane service; if that is what you find, it should not be reachable from outside the management network."
  },
  "checkCommand": "nmap -sV -Pn -p 9111 TARGET",
  "links": [
    {
      "title": "IANA port registry — 9111 (hexxorecore)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=9111",
      "kind": "iana"
    },
    {
      "title": "nmap-services (records the older DragonIDSConsole label)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ]
}