Guess what has telnet enabled and TCP/1138. Telnet is obvious but I'm still working on TCP/1138. 

Expander Info
Device ID   : 8005
Device Rev  : C
SAS Address : 500093d002856080
     Vendor : NEWISYS
    Product : NDS-4600-JD
Product Rev : 0509
Firmware Ver: 05.09.05
PowerOn     : Single Mode
       Slot : A
       Role : Secondary
    Address : 01
 Zoning Cfg : 00

Init String
    Device id : 8005
   Device Rev : C
  Flash tbl rv: 00000000
 EEPROM tbl rv: ffffffff
       Vendor :
      Product :
     Revision : 0509
  Vendor Spec : 05.09.05
Command          Description
menu             Menu of commands
help             Alias of menu
r32              Read expander register: r32 <addr>
w32              Write expander register: w32 <addr> <data>
md               Memory Dump: md <addr> <length>
info             Display IOM info
scp              SCP Functions: 'scp help' for details
i2c              I2C Functions: 'i2c help' for details
fan              Fan Functions: 'fan help' for details
vpd              VPD Functions: 'vpd help' for details
xc               Expander Comm: 'xc help' for details
reboot           Reset IOMs (this and other)
temp             Temperature Functions: 'temp help' for details
select           Select Expander, pri, sec1, or sec2
dm               Diagnostic Menu
ecr              Display Expander Crash record
fpga             Issue FPGA commands: fpga <cmd>  cmd = info, program, version
mii              Read Ethernet Phy registers
mac              Read Ethernet MAC registers
syslog           Setup syslog or send a message
log              Log
set              Set configurable parameters, 'set' for a list
show             Show component information, 'show help' for help
display              Display component information, 'help' for a lis
phycfg              Display PHY configuration values
ping             Ping
single      Single IOM download toggle
trace       Trace [on|off]
enable       Enable host ports
disable       Disable host ports
prompt           Prompt on/off
reset            Reset Device :
rd_32            32-bit Read  : rd_32 <address> <# of 32 bit words>
wr_32            32-bit Write : wr_32 <address> <data> [<address> <data>, ...]
rd_16            16-bit Read  : rd_16 <address> <# of 16 bit words>
wr_16            16-bit Write : wr_16 <address> <data> [<address> <data>, ...]
rd_8             8-bit Read  : rd_8  <address> <# of 8 bit words>
wr_8             8-bit Write : wr_8  <address> <data> [<address> <data>, ...]
rd_seeprom       8-bit Read  : rd_seeprom <port_id> <device address> <offset>
                    <offset width> <# of 8 bit words>
wr_seeprom       8-bit Write : wr_seeprom <port_id> <device address> <offset>
                    <offset width> <data> [<data>, ...]
dwld             Download     : dwld -fl|-se <offset> <hexdata0>...
dbs              Database Read: dbs  <page>
ipconfig         Show/Config IP: ipconfig [[help]|[dhcp 0|1 [ip ip_addr]
                   [nm netmask] [gw gateway]]]
qinfo            Query flash partition informations,internal debug use only
hash_tbl_map_get Retrieves the indices of non-zero hash table entries
rd_ecbi          ECBI read: rd_ecbi <address> [<address>, ...]
wr_ecbi          ECBI write: wr_ecbi <address> <data> [<address> <data>, ...]
ind_sel          Indirect select: ind_sel <table> <data>
ind_ecbi_rd      Indirect ECBI read: ind_ecbi_rd <address> [<address>, ...]
rd_see           Read SEEPROM : rd_see <offset> <num bytes>
smp              SMP command : smp <data> [<data>, ...]
DFE_asyncEye     DFE Eye Capture: DFE_asyncEye <phy_number> <ncount> <phases>