000032321 - Host and Service Ports for RSA NetWitness Endpoint

Document created by RSA Customer Support Employee on Jul 4, 2016•Last modified by RSA Customer Support on Feb 16, 2018
Version 8Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000032321
Applies ToRSA Product Set: ECAT, NetWitness Endpoint
RSA Version/Condition: 4.x
IssueThe attached document describes the ports used from the RSA ECAT Server to hosts:
  • ECAT Server to ECAT SQL Server
  • ECAT Agent to ECAT Server
  • ECAT UI to  ECAT SQL Server
  • ECAT UI to ECAT Server
  • ECAT Server to SA
  • ECAT Server to Log Decoder
  • ECAT Server  to Live
  • ECAT Server to File Share
  • ECAT SQL  Server to File Share
  • ECAT UI to File Share
  • ECAT Server to Queued Data Folder
  • ECAT SQL Server to Queued Data Folder
  • ECAT Server to RAR ( Remote Access Relay)
  • ECAT Agent to RAR ( Remote Access Relay)
Resolution
TrafficPort(s)
ECAT Server to ECAT SQL Server1433 (TCP)
ECAT Agent to ECAT Server443 (TCP) 444 (UDP)
ECAT UI to  ECAT SQL Server1433 (TCP)
ECAT UI to ECAT Server9433 (TCP) 808 (TCP)
ECAT Server to SA5671 (TCP) 443 (TCP)
ECAT Server to Log Decoder(Or 3rd Party Syslog server)514 (UDP)*
ECAT Server  to Live443 (TCP)
ECAT Server to File Share445, 137, 139
ECAT SQL  Server to File Share445, 137, 139
ECAT UI to File Share445, 137, 139
ECAT Server to Queued Data Folder445, 137, 139
ECAT SQL Server to Queued Data Folder445, 137, 139
ECAT UI, custom client app, or browser to ECAT Server                             9433     
ECAT Server to RAR ( Remote Access Relay)443(TCP) 444(UDP) 5671(RabbitMQ)**
ECAT Agent to RAR ( Remote Access Relay)443 (TCP) 444 (UDP)*


*   For Syslog TCP connections, check the syslog server documentation for correct TCP port
**  Applies to ECAT version 4.1.x only

Attachments

Outcomes