From: Go_ISS (greensandgmail.com)
Date: Tue Jun 07 2005 - 07:41:32 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

The communication from SiteProtector to the sensors happens on
different ports, depending on the sensor type. For daemon sensors
(sensors which have an issDaemon and an issCSF process), communication
occurs on two channels:

- The Command/Control channel: The "SiteProtector Sensor Controller
Service" (SPSenCtl.exe) on the Application Server machine (part 2 of a
custom install) connects to the sensor's issDaemon process on port
2998. This is to perform command and control operations such as
sensor Starts, Stops, Policy pushes, and Apply XPUs. If this
connection is blocked, the sensor will be reported as "Not
Responding".

- The Event channel: The Event Collector's issCSF process connects to
the Sensor's issCSF process on the sensor's event port. This is to
collect events from the sensors. If the event channel connection is
broken or unable to connect, the sensor will be reported as "Offline".
What the event port is depends on the type of sensor. For example:
901 - Network Sensor #1
901 - Fusion
902 - Server Sensor
904 - Network Sensor #2
907 - Network Sensor #3
910 - Network Sensor #4
912 - Stacked Event Collector
914 - Agent Manager/Desktop Controller
60155 - Internet Scanner

The daemon sensors do not initiate any contact with the exception of
Fusion and Agent Managers. SiteProtector only initiates contact to
the sensors. You can find a full port diagram of what SiteProtector
components connect to what on what ports in KBA #2767:
http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=2767

On 6/5/05, hic sonni <a_hicyahoo.com> wrote:
> Hi all,
>
> Hi all,
>
> We've Siprotector 5 SP2,
>
> I've a Firewall and I've all SP component installed in
> one machine. I'd like to open port for Site protector
> components; I'd like to know which port are use by
> Sensors,
> I remarked that only the 2998 ports is used by the
> RSSP, only connection from the Site protector (when
> Event viewer is installed) are being seen, I don't
> see any connection from the Server Sensor or net
> sensor to the Event viewer I feel that the connection
> between them isn't in the tow way , i.e. the Event
> viewer retrieve data from the sensors?? Is it
> different from the earlier versions of Site protector?
>
> Sincerely;
>
>
>
>
> __________________________________
> Discover Yahoo!
> Have fun online with music videos, cool games, IM and more. Check it out!
> http://discover.yahoo.com/online.html
>
> _______________________________________________
> ISSForum mailing list
> ISSForumiss.net
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforumiss.net
>
> The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>

_______________________________________________
ISSForum mailing list
ISSForumiss.net

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforumiss.net

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]