What port does the check for running process

[tacllem]

Hello.
Might anyone know what port is used in the firewall when i do the test "Process" I want to see that an application is running on a machine in the network. Our security people wont let me turn off the firewall.

THanks.

[KS-Soft]

FAQ
https://www.ks-soft.net/cgi-bin/phpBB/v ... php?t=6230

....
HostMonitor uses Windows RPC for the following test methods:
- NT eventlog test
- Services test
- Process
- Dominant Process
- Performance counter test
- CPU usage
- WMI test
Windows RPC calls may use any port above 1024.

How to configure RPC dynamic port allocation to work with firewalls
http://support.microsoft.com/kb/154596

Another useful article from Microsoft: network port requirements for the Windows Server system
http://support.microsoft.com/kb/832017

Note: the default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008.
To comply with Internet Assigned Numbers Authority (IANA) recommendations, Microsoft has increased the dynamic client port range for outgoing connections in Windows Vista and in Windows Server 2008. The new default start port is 49152, and the default end port is 65535. This is a change from the configuration of earlier versions of Windows that used a default port range of 1025 through 5000.
http://support.microsoft.com/kb/929851

On the other hand, firewall that passes thru NetBIOS, RPC, DCOM traffic does not have much sense. If you need to monitor remote network protected by firewall, we strongly recommend using Remote Monitoring Agent (RMA)
http://www.ks-soft.net/hostmon.eng/rma-win/index.htm

Regards
Alex

[KS-Soft]

Unless you are using SNMP mode for the test, then single UDP port is used, the one you set for SNMP agent on target system