Network Prerequisites for Scanning

Before running scan jobs, confirm the appliance has network access to the systems in scope. This is separate from the appliance’s own connectivity to the cloud Console β€” see Network requirements for that.

Target System Ports

Configure any firewalls between the appliance and the scanned systems to allow the following traffic.

Inventory and Discovery

Port Protocol Direction Description OS
N/A ICMP Appliance β†’ target Optional: remote echo (ping) All
22 TCP Appliance β†’ target SSH, used to run remote commands Unix/Linux
135 TCP Appliance β†’ target RPC Endpoint Mapper Windows
137, 138 TCP/UDP Appliance β†’ target Optional: NetBIOS name service Windows
139 TCP/UDP Appliance β†’ target NetBIOS session service; required for the C$ share on older systems Windows
445 TCP Appliance β†’ target SMB file sharing; required for the C$ share Windows
443, 9443 TCP Appliance β†’ target HTTPS, used when a vCenter agent listens on this port Windows / vCenter
1025–5000 / 49152–65535 TCP Target β†’ appliance Dynamic ports for WMI responses (range depends on Windows version) Windows

Application-Specific Scanning

Port Protocol Description
1433 TCP Required to scan SQL Server endpoints
1521 TCP Required to scan Oracle endpoints

Other application-specific ports may need to be opened depending on what is being scanned.

Note

Traffic Volume

Scan traffic is bursty rather than constant: expect short bursts of upload activity as each scan completes, followed by idle periods, rather than a steady stream. Size firewall and IDS alerting thresholds accordingly β€” see Scanning network behavior for what this traffic looks like to security monitoring tools.

With network access confirmed, gather the Credentials the appliance needs to authenticate to each target.