Network ports used for discovery communications - Documentation for BMC Helix Discovery

Base device discovery

For efficiency, the BMC Helix Discovery Outpost uses ICMP ping to locate a device. It is possible to use other ping techniques if ICMP Echo is suppressed in your environment. To do so, on the Administration tab, scroll down to the Discovery section and click Discovery Configuration. In the Scanning section, enable the Use TCP ACK 'ping' before scanning and Use TCP SYN 'ping' before scanning check boxes, and enter the port numbers in the TCP ports to use for the initial scan and UDP ports to use for the initial scan fields.

Important

To scan networks that do not permit ICMP ping packets, you may set Use TCP ACK ping before scanning or Use TCP SYN ping before scanning (or both of these) in your discovery settings to Yes. If BMC Helix Discovery pings an IP address where there is no device and some firewall in your environment is configured to respond for that IP address, it may result in reporting a device which does not exist on the network rather than dark space (NoResponse). To avoid this, it is recommended to either alter such firewall configurations or not to enable TCP ACK ping or TCP SYN ping.

If BMC Helix Discovery cannot connect to an endpoint, it uses heuristic techniques to estimate what sort of device is present. These are controlled by options in Configuring discovery settings.

Port 4 using TCP and UDP is required if using IP Fingerprinting as Discovery must observe the response from a guaranteed closed port on the endpoint.

Port 4 must be closed on the discovery target but must be open on any firewall between the appliance (or instance) and discovery target, so that the response is from the target rather than the firewall. Where this is not the case, the heuristic receives a response from two different TCP/IP stacks, leading to unpredictable results including the endpoint being classified as a firewall or an unrecognized device. This can lead to skipped devices (see UnsupportedDevice in the DiscoveryAccess page).

The ports listed in the following table are used to determine what device is present.

SNMP ports used for discovery

The only port required for SNMP discovery is 161 UDP.

UNIX ports used for discovery

The minimum port required for successful UNIX discovery is just the port associated with the access methods that you use. For example, if you only use ssh, this will be port 22. The following table details the assignment for each port number.

Windows ports used for discovery 

This section describes the ports that the BMC Discovery Outpost uses when discovering remote Windows targets. If you intend to discover hosts behind a firewall, you must open these ports in the firewall. The ports given are outgoing (from the Windows proxy and the instance) TCP ports.Windows targets and port 135The Outpost scans port 135 to determine whether the port is open. If port 135 is open, the target is likely to be a Windows host, and further discovery is performed accordingly. You can disable the scan of port 135. If you do so, BMC Helix Discovery assumes that all targets are Windows hosts.To disable scanning port 135:

PowerShell

All PowerShell communication from BMC Helix Discovery appliance (or instance), BMC Discovery Outpost, or Windows AD proxy is sent over HTTP or HTTPS, using the normal PowerShell ports rather than the standard web ports (443/80).

The ports that are used by PowerShell discovery and the corresponding assignments are described in the following table.

WMI

All WMI communication from BMC Helix Discovery is sent with Packet Privacy enabled. If the host being discovered does not support Packet Privacy, the flag is ignored and WMI returns the requested information (for example, if you run a version earlier than Windows Server 2003 with Service Pack 1 (SP1)). In cases where a range is provided, one of the ports is used after initial negotiation.

Important

By default, WMI (DCOM) uses a randomly selected dynamic port range for TCP between 49152 and 65535. For more information on this port range, see this Microsoft article .

To simplify the configuration of the firewall, you should restrict this usage if you scan through firewalls. See to set the DCOM Port Range for more information.

The ports that are used by WMI discovery methods and the corresponding assigned ports are described in the following table.

Windows NT4 and NT4 style domains (WMI)

TCP 139 is required instead of TCP 445 if you discover NT4 or you authenticate on an NT4-style non-AD Domain (such as a domain run using Samba 3.x or earlier).

TCP 139 is the NetBIOS Session Service. Some versions of Windows (particularly 9x/NT4) run SMB on NetBIOS over TCP using port 139. Newer versions default to running SMB directly over TCP on port 445. Windows XP/2003/Vista/2008 and later and Active Directory networks use SMB directly over TCP 445.

WMI queries from a Windows Server 2008 to a Windows NT4 host fail using the default security settings. On the Windows proxy host, turn off the requirement for 128-bit security in the Network security: Minimum session security for NTLM SSP based (including RPC) clients policy to permit this.

DCOM port range 

WMI is based on the Distributed Component Object Model (DCOM) which, by default, uses a randomly selected TCP port between 49152 and 65535 for communications. To make this more efficient for firewalls, the range can be restricted using the following procedure on each Target Host. For more information about this issue, see How to configure RPC dynamic port allocation to work with firewalls.

Important

These settings should be restricted on the target host, not the BMC Helix Outpost host.

To set the DCOM port range:.

RemQuery

Although WMI is the standard mechanism for remote system interrogation and management from Microsoft. However, some operations are not possible using WMI. Primarily netstat data in core discovery, and any additional commands run, or file content extraction, via patterns. Without RemQuery, it is not possible to determine network connection information for the discovery target, communication between that host and others, and application modeling based on network connections. Additional discovery operations using RemQuery are typically for deeper software discovery, modeling, and versioning.

RemQuery is a BMC Helix Discovery utility that uses the same basic approach as the Microsoft PSExec tool. The proxy copies the RemQuery executable to the ADMIN$ share on the target. Windows Administrator access is required to write to the ADMIN$ share and start the RemQuery service. Once the service is started on the target, the proxy sends its public key to the RemQuery service, which generates an encryption key, encrypts it with the received public key, and then sends it back. The proxy then recovers the encryption key using its private key. From that point, all proxy to RemQuery communication is secured using the encryption key and an appropriate algorithm, depending on the target system. RemQuery discovery uses AES encryption with a 256-bit key. AES is not supported in Windows 2000 so RemQuery discovery falls back to DES encryption. Windows NT does not support AES or DES so RemQuery discovery is unencrypted. The proxy communicates to the RemQuery service using a named pipe. This pipe is secured so that only an Administrator user can access it.

The ports that are used by RemQuery discovery and the corresponding port assignments are described in the following table.

Windows NT4 and NT4 style domains (RemQuery)

TCP 139 is required instead of TCP 445 if you discover NT4 or if you authenticate on an NT4-style non-AD Domain, such as a domain run using Samba 3.x or earlier.

TCP 139 is the NetBIOS Session Service. Some versions of Windows (particularly 9x/NT4) run SMB on NetBIOS over TCP using port 139. Newer versions default to running SMB directly over TCP on port 445. Windows XP/2003/Vista/2008 and later and Active Directory networks use SMB directly over TCP 445.

Mainframe ports used for discovery

The only port required for mainframe discovery is 3940 TCP. For more information about how to configure this port, see Discovery Configuration.

WBEM ports used for discovery

The default ports used for WBEM discovery are described in the following table. For more information about how to configure this port, see Discovery Configuration.

Ports required for extended discovery

The following sections detail port information for extended discovery types.

SQL discovery 

The port information used for SQL discovery is derived in the patterns used to discover the particular database. This is dependent on the way that databases are configured in your organization. The following table details the default ports.

VMware ESX/ESXi discovery using vCenter 

The ports required for the discovery of VMware ESX/ESXi hosts using vCenter are listed in the following table.

Important

Discovery of vCenter uses standard host discovery with the creation of a vCenter SI triggered on a discovered vCenter process.

VMware ESX/ESXi discovery using vSphere

The ports required for the discovery of VMware ESX/ESXi hosts are listed in the following table.

ncG1vNJzZmicn5jAb67MnGWcp51ksbCv0miboquTpMOmvthom5qZo2S7psDWqKmkZaCkv7W%2FjK6qnpxdm7yzecOiqpynppq%2FunnCqKSmrZ6esKLAyKilrGVoboV1fZJsbW1mmKm6rQ%3D%3D