Web Reputation Default Port

Usage and Config Security
1

(imported topic written by SystemAdmin)

Ran into an interesting one with the default port that Web Reputation tmproxy service runs with (6999). It appears that when CPM is installed it creates the tmproxy service with the default proxy port of 6999. If you then enable web reputation after (by default disabled) - and that port is already in use - it increments up one to 7000. If 7000 is in use it goes to 7001, 7002 and so on.

Our fun began when numerous workstations could no longer use a scanning application that by default uses port 7000. Not sure what application originally had 6999 in use that would of then pushed tmproxy to 7000 - but since the tmproxy service comes up first when the OS loads - and our application of 7000 after - we had a conflict.

We created a task that set the default port back to 6999 and all was well. Now we are monitoring to see if tmproxy auto changes again due to a conflict with 6999. I believe it only happens with the first initial enable of web reputation. We have not had evidence yet that the port fluctuates.

So if you find a conflict with an application that utilizes 6999 - 7002 and you are running CPM Web Reputation - take a peak at the below reg setting to see what it is set too.

HKEY_LOCAL_MACHINE\SOFTWARE\TrendMicro\NSC\TmProxy\ProxyPort

Cheers,

Mike

2

(imported comment written by SystemAdmin)

I met up with a member of Trend at The New England IANS Security Forum last week and asked him about this and he said they found this “port drift” (as I like to call it) to be an odd occurrence and that they are going to change this to be hard coded in a future update. For time being we created a task that changes the port back to the default of 6999 if it “drifts” to port 7000.

Cheers,

Mike