Surveyor User's Guide

4-25

Configuring Surveyor

Advanced Configuration

Monitoring Non Well-Known Ports

Surveyor also collects information about a subset of ports that fall outside of the

WKP range, port numbers greater than 1023. These ports are called non-WKP.

Some of these ports are monitored by Surveyor since applications associated with

them are widely accepted. The non-WKP ports that Surveyor monitors and their

associated port values are listed in Table 4-11 and Table 4-12.

Surveyor treats all other non-WKP as a single entity given a single generic name.

The name for TCP non-WKP ports is “TCP OTHER”. The name for UDP non-

WKP ports is “UDP OTHER”. For example, if 900 occurrences of the TCP port

11964 was detected and 200 occurrences of the TCP port 10564, there would be a

single name to identify these 1100 occurrences of the TCP non-WKPs called “TCP

OTHER”.

Table 4-11. Default Names for Non-WKP TCP Ports

Name TCP port values

LOTUS NOTES 1352

TNS (Sybase) 1521

RSP 1704

TDS (Oracle) 2048

NFS 2049

CC:MAIL 3264

XWIN 6000-6063

Table 4-12. Default Names for Non-WKP UDP Ports

Name UDP Port Value

RADIUS 1645

RSP 1704

RADIUS 1812

HSRP 1985

NFS 2049

RTP 5004

RTCP 5005