Hello, The communication from SiteProtector to the sensors happens on different ports, depending on the sensor type. For daemon sensors (sensors which have an issDaemon and an issCSF process), communication occurs on two channels:
- The Command/Control channel: The "SiteProtector Sensor Controller Service" (SPSenCtl.exe) on the Application Server machine (part 2 of a custom install) connects to the sensor's issDaemon process on port 2998. This is to perform command and control operations such as sensor Starts, Stops, Policy pushes, and Apply XPUs. If this connection is blocked, the sensor will be reported as "Not Responding". - The Event channel: The Event Collector's issCSF process connects to the Sensor's issCSF process on the sensor's event port. This is to collect events from the sensors. If the event channel connection is broken or unable to connect, the sensor will be reported as "Offline". What the event port is depends on the type of sensor. For example: 901 - Network Sensor #1 901 - Fusion 902 - Server Sensor 904 - Network Sensor #2 907 - Network Sensor #3 910 - Network Sensor #4 912 - Stacked Event Collector 914 - Agent Manager/Desktop Controller 60155 - Internet Scanner The daemon sensors do not initiate any contact with the exception of Fusion and Agent Managers. SiteProtector only initiates contact to the sensors. You can find a full port diagram of what SiteProtector components connect to what on what ports in KBA #2767: http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=2767 On 6/5/05, hic sonni <[EMAIL PROTECTED]> wrote: > Hi all, > > Hi all, > > We've Siprotector 5 SP2, > > I've a Firewall and I've all SP component installed in > one machine. I'd like to open port for Site protector > components; I'd like to know which port are use by > Sensors, > I remarked that only the 2998 ports is used by the > RSSP, only connection from the Site protector (when > Event viewer is installed) are being seen, I don't > see any connection from the Server Sensor or net > sensor to the Event viewer I feel that the connection > between them isn't in the tow way , i.e. the Event > viewer retrieve data from the sensors?? Is it > different from the earlier versions of Site protector? > > Sincerely; > > > > > __________________________________ > Discover Yahoo! > Have fun online with music videos, cool games, IM and more. Check it out! > http://discover.yahoo.com/online.html > > _______________________________________________ > ISSForum mailing list > [email protected] > > TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to > https://atla-mm1.iss.net/mailman/listinfo/issforum > > To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] > > The ISSForum mailing list is hosted and managed by Internet Security Systems, > 6303 Barfield Road, Atlanta, Georgia, USA 30328. > _______________________________________________ ISSForum mailing list [email protected] TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to [EMAIL PROTECTED] The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
