Our system's Event Viewer has received a handful of "Denied traffic to enVision" events that reference port 2010.
Usually, these events are simple denies from unknown addresses. But, the ones we got state that the source is one or two of my collectors on port 2010, denied trying to talk to the D-SRV on a higher , port, usually 3000 range.
I looked on 6 of my 8 collectors, and all have at least four established 2010 sessions open with the D-SRV.
Does anyone know what these are?
Port 2010 is a standard port that enVision uses for a lot of its inter-appliance communication, as well as some of the client data access to the IPDB.
See the "Ports Used by enVision" help topic in the enVision Help system for all the gory details!