Registered to Micromuse, but in the wild it is either Logstash's monitoring API or an OMRON PLC speaking FINS.
IANA's assignment is micromuse-ncpw, from the Micromuse/Netcool product line. Two unrelated modern uses dominate what you actually find. Logstash binds its HTTP monitoring API to tcp:9600 by default, serving unauthenticated JSON about pipelines, plugins, and JVM state. On industrial networks, OMRON PLCs speak the FINS protocol on 9600 over both TCP and UDP — Nmap ships an omron-info script that queries controller details there. A banner grab tells the two apart immediately: JSON means Logstash, binary means a PLC.
Do not expose
Both realistic occupants are bad news exposed. The Logstash API is unauthenticated introspection of your pipeline, and FINS is an unauthenticated industrial control protocol that should not touch a routable network at all.
$ curl -s http://TARGET:9600/Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.