What are the open ports on the Symantec Security Information Manager v4.6

Products

• Security Information Manager

Issue/Introduction

Resolution

The main iptables firewall on the Symantec Security Information Manager v4.6 has been modified to deny everything by default and only accept connections for the following applications and ports.:

Application	Port
Ssh	22
https	443
Syslog	514
Ldaps	636
Ibmdiradm	3539
Db2tcpcm	3700
Simserver	10010
eventservice	10012
Db2tcp	50000
Ethereal ports	10099-49999
Collector ports	10514-10650

Ports that are listening on 127.0.0.1 i.e the loopback IP address do not need to be blocked on the firewall.

The following is a list of all the known ports and their bound IP’s that are present on a SSIM appliance:

Port	Protocol	Firewall blocked	Process
127.0.0.1:80	tcp	yes	http
50000	tcp	no	Db2tcpcm
3700	tcp	no	Db2tcpcm
127.0.0.1:10080	tcp	Yes	assetsvc
127.0.0.1:55557	tcp	yes	assetsvc
127.0.0.1:10050	Tcp	Yes	Manager
127.0.0.1:8005	Tcp	Yes	Manager
127.0.0.1:8009	Tcp	yes	manager
10021	Tcp	Yes	simserver
10010	Tcp	No	simserver
127.0.0.1:55558	Tcp	Yes	Notificationsvc
10022	Tcp	Yes	eventservice
127.0.0.1:8015	Tcp	Yes	eventservice
127.0.0.1:8019	Tcp	Yes	eventservice
8090	Tcp	yes	eventservice
10012	tcp	no	eventservice
127.0.0.1:55559	Tcp	Yes	Rulesvc
127.0.0.1:55560	Tcp	Yes	Dimserver
127.0.0.1:55561	Tcp	Yes	Schedulersvc
127.0.0.1:55562	Tcp	Yes	Icesvc
127.0.0.1:10030	Tcp	Yes	Simdbmu
127.0.0.1:55566	Tcp	Yes	Kbsvc
5998	Tcp	Yes	Agent
127.0.0.1:55567	tcp	yes	Ticketsvc
127.0.0.1:55568	tcp	yes	Eventfindersvc
127.0.0.1:55569	tcp	yes	Querysvc
127.0.0.1:55570	tcp	yes	Statsvc
3539	Tcp	No	ibmdiradm
127.0.0.1:55571	Tcp	Yes	Configurationsvc
127.0.0.1:8086	Tcp	Yes	Agent
22	Tcp	No	ssh
443	Tcp	No	https
636	Tcp	No	ldaps
18777	Udp	Yes	Svclauncher
127.0.0.1:8025	Tcp	Yes	Wsrf
127.0.0.1:8029	tcp	yes	Wsrf
127.0.0.1:55550	Tcp	yes	rxservice
127.0.0.1:8889	Tcp	Yes	QueueMonitor