Measured from the cluster the port is shut; measured from sorb's Mac it answered,
because the lab reaches CFGMON over the site coupling, which the cloud firewall does
not filter. The rule is fine and so is the service.
What was actually broken is my check: its counter-probe proves the method works, not
that the vantage point is external. pruefe-ports.sh now probes its own location
first and refuses to score the closed-port half from a privileged network.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Thore CimbalandClaude Opus 5
23117472e6