{
  "port": 912,
  "protocol": "tcp",
  "service": "VMware Authorization Service (Workstation/Player) — IANA: apex-mesh",
  "oneLiner": "Registered by RFC 3340 for APEX relay traffic, but what actually listens here is VMware Workstation's authorization service on Windows.",
  "whatItIs": "RFC 3340 defines the Application Exchange (APEX) core and registers apex-mesh on 912 for relay-to-relay connections between APEX servers; APEX never saw real deployment, so nothing speaks it. On a Windows desktop, 912 is where vmware-authd — the VMware Authorization Service installed by Workstation and Player — listens to authorize users starting or connecting to virtual machines. Finding 912 open next to 902 on a Windows host is a strong Workstation fingerprint.",
  "exposure": {
    "verdict": "never",
    "note": "It is a virtual-machine authorization and control interface running with high privilege on a desktop; it has no reason to be reachable off the machine, let alone from another network."
  },
  "checkCommand": "nc -v -w 3 TARGET 912",
  "links": [
    {
      "title": "RFC 3340 — The Application Exchange Core (registers apex-mesh on 912)",
      "url": "https://www.rfc-editor.org/rfc/rfc3340.html",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 912",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=912",
      "kind": "iana"
    },
    {
      "title": "nmap-services (912/tcp apex-mesh)",
      "url": "https://github.com/nmap/nmap/blob/master/nmap-services",
      "kind": "github"
    }
  ],
  "ianaName": "apex-mesh"
}