Best practices

Services built on rpcbind - NFS, mountd, nlockmgr, status, and related RPC programs - don't keep a fixed port-to-program mapping. The same ephemeral port can register as nlockmgr on one scan and unknownor a different RPC program on the next, purely because that's how the RPC portmapper works, not because anything changed about the service itself.

If you run NFS (or another rpcbind-based service) and expect it to keep running, SurfaceDiff will correctly report every one of these fingerprint changes as a separate Service changedincident - that's the system doing its job, reporting a genuine, observed difference between scans. It's just not one you need to review every time.

What to do:mute the specific port once. From the incident, click through to the affected domain, find the port in the "Open ports" section, and click Mute. Future fingerprint changes on that exact host and port stop being emailed to you - though you'll still see a record of them in your incident history, already marked reviewed, not hidden. If the service ever stops responding entirely, or a genuinely new port opens, that's a different incident type (Port closed / Port opened) and isn't affected by this mute.

Acknowledge(and Ignore, Resolve) apply to one specific incident - they record how that single event was handled, for the audit trail. They don't change whether the same kind of change alerts you again next time. Muteis the one that actually stops future recurrences of that specific finding from reaching your inbox. If something keeps coming back after you've acknowledged it a few times, Mute - not repeated Acknowledging - is what you want.