EDR: What is UDP port 24884 used for?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What is UDP port 24884 used for on the EDR server?

Environment

• EDR: 7.8.0 and higher

Resolution

Beginning with EDR 7.8.0, UDP port 24884 is part of the Jolokia agent which is used with the datastore process and IPv6. This was added to enable IPv6 support in 7.8.0.

To disable the use of this port:

1. Log into the server.
2. Edit /etc/cb/datastore/datastore.in
3. Append additional text at the end of the following line:

(original line)
DATASTORE_OPTS="${DATASTORE_OPTS} -javaagent:/usr/share/cb/datastore/bin/jolokia-jvm-agent.jar=port=${DatastoreMetricsPort},host=localhost"

(modified line)
DATASTORE_OPTS="${DATASTORE_OPTS} -javaagent:/usr/share/cb/datastore/bin/jolokia-jvm-agent.jar=port=${DatastoreMetricsPort},host=localhost,discoveryEnabled=false"

4. Repeat this process for all nodes, primary and secondary servers.
5. Restart the cluster.

Additional Information

• Although disabling this port shouldn't have any adverse effect in the most common scenarios, it's recommended not to disable this port unless you have a specific need to do so. 
• An enhancement request (CB-43427) has been created to disable this port by default in a future version of the product.