Cb Response: Are ports 53, 67, and 68 accessible from any host during endpoint isolation?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

While an endpoint is isolated, is it accessible through ports 53, 67, and 68 from any host?

Environment

• Cb Response: 6.x
• Cb Response Sensor: All supported versions
• Endpoint isolated

Resolution

Ports remaining open while an endpoint is isolated:

• UDP/53
• UDP/67
• UDP/68

Port 53 is for DNS, and ports 67 and 68 are for DHCP. Any host can communicate with the endpoint over those ports and protocols.