AppleTV & nmap -sV

A researcher observed that an Apple TV (tvOS 9.2.2) can be woken from the network by a minimal HTTP GET to port 3689. Using tcpdump, Wireshark, and netcat, the author traced the wake event to a generic GET sent during an nmap version scan and demonstrates that the service responds even when the device appears “off,” implying exposed functionality on that port that may not require authentication.