A blockchain node built on Parity's Substrate — its JSON-RPC endpoint, serving HTTP and WebSocket on the same port.
Substrate hardcodes RPC_DEFAULT_PORT = 9944 in substrate/client/cli/src/config.rs, so every node built on the framework — Polkadot, Kusama, parachains, and any --dev chain a developer starts locally — listens here by default. Older releases split the endpoint (9944 WebSocket, 9933 HTTP); current ones serve both on 9944. The port carries no IANA registration. Seeing it open means someone is running a node, and a JSON-RPC call like system_chain will tell you which network.
Do not expose
Started with --rpc-external or --rpc-methods=unsafe, the endpoint exposes author_ and system_ methods that can insert keys and reconfigure the node. Keep it bound to localhost and put a method-filtering reverse proxy in front if it must be reachable.
$ curl -sS -H 'Content-Type: application/json' -d '{"jsonrpc":"2.0","id":1,"method":"system_chain","params":[]}' http://TARGET:9944Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.