Internet-Security.com TCP port 8649 details

TCP port 8649 is used by the Ganglia Monitoring System’s gmond (Ganglia Monitoring Daemon).
gmond exposes a real-time XML stream of host metrics on TCP/8649, which is polled by gmetad and Ganglia web front ends.
This default is used in real deployments such as the Rocks Cluster Distribution and many Hadoop stacks (e.g., older Cloudera/CDH deployments) for cluster monitoring.
AWS EMR’s optional Ganglia integration also relies on gmond listening on 8649 within the cluster.
Publicly exposed gmond on 8649 has been used for reconnaissance because it can leak detailed system metrics, so access is typically restricted.

TCP 8649