I have SEP 11.6 installed on several servers. Using Windows Network monitor, I captured dozens of attempts to go to port 80 at external IPs by RTvscan.exe. That's just in one night. We use a central management server and all servers are updating correctly. I've seen this question asked a couple different time, but no one seems to have an answer. Anyone know why Rtvscan is doing this?