Which communication ports does Symantec Endpoint Protection use?

Article:TECH163787  |  Created: 2011-07-01  |  Updated: 2014-09-19  |  Article URL http://www.symantec.com/docs/TECH163787
Article Type
Technical Solution


Issue



Which communication ports does Symantec Endpoint Protection use?


Solution



The following table lists ports and processes associated with Symantec Endpoint Protection 11.0, 12.0 and 12.1:

Communications Ports and Protocols

Port Number Port Type Initiated By Listening Process Description
8014 / 80 TCP Symantec Endpoint Protection clients httpd.exe (Apache)
svchost.exe (IIS)
Communication between the Symantec Endpoint Protection Manager and Symantec Endpoint Protection clients and Enforcers.
(8014 in MR3 and later builds, 80 in older).
The 12.x product line uses Apache. The 11.x product line uses IIS.
443 TCP Symantec Endpoint Protection clients svchost.exe (IIS)
httpd.exe (Apache)
Optional secured HTTPS communication between a Symantec Endpoint Protection Manager and Symantec Endpoint Protection clients and Enforcers.
1100 TCP AjaxSwing httpd.exe (Apache) Tells AjaxSwing on which port to run RMI Registry. (12.1.x)
1433 TCP Symantec Endpoint Protection Manager sqlserver.exe Communication between a Symantec Endpoint Protection Manager and a Microsoft SQL Database Server if they reside on separate computers.
1812 UDP Enforcer 12.x: httpd.exe (Apache)
11.x: w3wp.exe
RADIUS communication between a Symantec Endpoint Protection Manager and Enforcers for authenticating unique ID information with the Enforcer.
2638 TCP Symantec Endpoint Protection Manager 12.1.x: dbsrv11.exe
11.x: dbsrv9.exe
Communication between the embedded database and the Symantec Endpoint Protection Manager.
2967 TCP Symantec Endpoint Protection Clients Smc.exe The Group Update Provider (GUP) proxy functionality of Symantec Endpoint Protection client listens on this port.
8765 / 8005 TCP Symantec Endpoint Protection Manager SemSvc.exe This is the Tomcat Shutdown port.
In the 12.x product line port 8765 is used.
In the 11.x product line SEP Manager listens on the Tomcat default port of 8005, except for RU7, which uses 8765. 
8045 TCP Symantec Endpoint Protection Manager SemSvc.exe In 11 RU6, Symantec Endpoint Protection Manager, the registry is started by the Tomcat servlet container. CreamTec's AjaxSwing uses the existing registry to communicate with its client agents that run in stand alone mode
8443 TCP Remote Java or
Web Console
SemSvc.exe HTTPS communication between a remote management console and the Symantec Endpoint Protection Manager. All login information and administrative communication takes place using this secure port.
8444 TCP Symantec Protection Center (SPC) 2.x SemSvc.exe This is the Symantec Endpoint Protection Manager web services port. SPC 2.x makes Data Feed and Workflow requests to Symantec Endpoint Protection Manager over this port.
8445 TCP Reporting Console httpd.exe (Apache) Added in 12.1.x. HTTPS reporting console.
8447 TCP Process Launcher semlaunchsrv.exe Added in 12.1.5. Only at localhost's request, this service virtual account launches processes that require higher privileges so that other Symantec Endpoint Protection Manager services do not require them.
9090 TCP Remote Web Console SemSvc.exe Initial HTTP communication between a remote management console and the Symantec Endpoint Protection Manager (to display the login screen only).
39999 UDP Enforcer SNAC.exe (Windows SNAC)
CClientCtl.exe (Windows ODC)
SNAC (Mac SNAC/ODC)
Communication between the Symantec Endpoint Protection clients and the Enforcer. This port is used for authentication of clients by the Enforcer.

In Symantec Endpoint Protection 12.1, Symantec Endpoint Protection Manager (SEPM) uses the Apache web server on the ports seen in the table above.

In Symantec Endpoint Protection 11, Symantec Endpoint Protection Manager uses two web servers: Internet Information Services (IIS) and Tomcat (Apache Tomcat). IIS uses port 80 (or 8014) and 443; Tomcat uses port 9090 and 8443. The communication between IIS and Tomcat use the HTTP protocol. IIS uses port 9090 to talk to Tomcat, and Tomcat uses port 80 to talk to IIS.

Client-Server Communication:
For IIS, Symantec Endpoint Protection uses HTTP or HTTPS between the clients or Enforcers and the server. For the client server communication it uses port 8014 (or 80) and 443 by default. In addition, the Enforcers use RADIUS to communicate in real-time with the manager console for client authentication. This communication is done on UDP port 1812.

Push deployment:
Management servers and clients use TCP 139 and 445, UDP 137 and 138, and TCP ephemeral ports for push deployment. As of 12.1.5, TCP 22 is used for push deployment of Mac clients.

Remote Console:
9090 is used by the remote console to download .jar files and display the help pages.
8443 is used by the remote console to communicate with SEPM and the Replication Partners to replicate data.
8444 is used by the SPC 2.x remote console to make Data Feed and Workflow requests.
8445 is used by SEPM for reporting data, and returns report data to SPC 2.x over this port.

Client-Enforcer Authentication:
The clients communicate with the Enforcer using a proprietary communication protocol. This communication uses a challenge-response to authenticate the clients. The default port for this is UDP 39,999.





Article URL http://www.symantec.com/docs/TECH163787


Terms of use for this information are found in Legal Notices