Hello,
The communication from SiteProtector to the sensors happens on
different ports, depending on the sensor type. For daemon sensors
(sensors which have an issDaemon and an issCSF process), communication
occurs on two channels:
- The Command/Control channel: The "SiteProtector Sensor Controller
Service" (SPSenCtl.exe) on the Application Server machine (part 2 of a
custom install) connects to the sensor's issDaemon process on port
2998. This is to perform command and control operations such as
sensor Starts, Stops, Policy pushes, and Apply XPUs. If this
connection is blocked, the sensor will be reported as "Not
Responding".
- The Event channel: The Event Collector's issCSF process connects to
the Sensor's issCSF process on the sensor's event port. This is to
collect events from the sensors. If the event channel connection is
broken or unable to connect, the sensor will be reported as "Offline".
What the event port is depends on the type of sensor. For example:
901 - Network Sensor #1
901 - Fusion
902 - Server Sensor
904 - Network Sensor #2
907 - Network Sensor #3
910 - Network Sensor #4
912 - Stacked Event Collector
914 - Agent Manager/Desktop Controller
60155 - Internet Scanner
The daemon sensors do not initiate any contact with the exception of
Fusion and Agent Managers. SiteProtector only initiates contact to
the sensors. You can find a full port diagram of what SiteProtector
components connect to what on what ports in KBA #2767:
http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=2767
On 6/5/05, hic sonni <a_hic@yahoo.com> wrote:
Hi all,
Hi all,
We've Siprotector 5 SP2,
I've a Firewall and I've all SP component installed in
one machine. I'd like to open port for Site protector
components; I'd like to know which port are use by
Sensors,
I remarked that only the 2998 ports is used by the
RSSP, only connection from the Site protector (when
Event viewer is installed) are being seen, I don't
see any connection from the Server Sensor or net
sensor to the Event viewer I feel that the connection
between them isn't in the tow way , i.e. the Event
viewer retrieve data from the sensors?? Is it
different from the earlier versions of Site protector?
Sincerely;
__________________________________
Discover Yahoo!
Have fun online with music videos, cool games, IM and more. Check it out!
http://discover.yahoo.com/online.html
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
_______________________________________________
ISSForum mailing list
ISSForum@iss.net
TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
To contact the ISSForum Moderator, send email to mod-issforum@iss.net
The ISSForum mailing list is hosted and managed by Internet Security Systems,
6303 Barfield Road, Atlanta, Georgia, USA 30328.
