Ports Used by the Appliance

Ports Used by the Appliance

The following table shows the ports that are used with Deep Discovery Web Inspector and why they are used.

Ports used by Deep Discovery Web Inspector

Port	Protocol	Function	Purpose
22*	TCP	Listening	Endpoints connect to Deep Discovery Web Inspector through SSH. *Because SSH is disabled by default, this port is not used by default. If you enable and start SSH, Deep Discovery Web Inspector then listens on this port.
53	TCP/UDP	Outbound	Deep Discovery Web Inspector uses this port for DNS resolution.
80*	TCP	Listening and outbound	Deep Discovery Web Inspector listens on this port when uploading Virtual Analyzer images. *All other access to Deep Discovery Web Inspector is secured by SSL, which uses 443.
123	UDP	Outbound	Deep Discovery Web Inspector connects to the NTP server to synchronize time.
161	UDP	Listening	Deep Discovery Web Inspector uses this port to listen for requests from SNMP managers.
162	UDP	Outbound	Deep Discovery Web Inspector connects to SNMP managers to send SNMP trap messages.
389	TCP	Outbound	Deep Discovery Web Inspector uses this port to do LDAP connections to Active Directory domain controller servers and to handle LDAP authentication.
443	TCP	Listening and outbound	Deep Discovery Web Inspector uses this port to: Query the Predictive Machine Learning engine Access the management console with a computer through HTTPS Communicate with Trend Micro Apex Central Communicate with Deep Discovery Director Connect to the Smart Protection Network and query Web Reputation Services Connect to Trend Micro Threat Connect Send anonymous threat information to Smart Feedback Update components by connecting to the ActiveUpdate server Send product usage information to Trend Micro feedback servers Share threat intelligence information and exception list with other products
443	TCP	Listening	Deep Discovery Web Inspector uses this port when authenticating and to redirect customers' web traffic to Captive Portal to do Kerberos/NTLM/Basic Captive Portal authentication.
3268	TCP	Outbound	Deep Discovery Web Inspector uses this port when authenticating and to redirect customers' web traffic to Captive Portal to do Kerberos/NTLM/Basic Captive Portal authentication.
User-defined	N/A	Outbound	Deep Discovery Web Inspector uses specified ports to: Send logs to syslog servers Share threat intelligence with integrated products/services Send emails by SMTP