Port 8005 Conflict with SCCM Express Installs

[Aoc]

MS SCCM is now using port 8005 for the Express Updates. Our McAfee IDS defaults to 8005. I just lost a huge amount of logging after systems were patched. I'm trying to understand why SCCM would choose this port. Any insight?

[fkazi04]

Hi,

It's quite challenging to tell why SSCM uses 8005 Port.

NSP uses ports in series of 85xx and not 8005. Can you please confirm which port are you referring to?

Following document should help you to get list of Ports used by McAfee NSP product:

https://kc.mcafee.com/corporate/index?page=content&id=KB59342

Regards,

Faizan

[Aoc]

Unable to get configuration information at this time.

[Aoc]

I don't see 8005 listed on the Knowledge Center. I'm not sure of specific configurations currently being once removed from the change order. This occurred after a series of patches, updates, and reboots. 

[petermason]

Hi Aoc,

I have recently had the same issue. After the managers were rebooted the NSP Manager service was unable to start.

The Manager logs showed the following error;

SEVERE: StandardServer.await: create[localhost:8005]:
java.net.BindException: Address already in use: JVM_Bind
        at java.net.DualStackPlainSocketImpl.bind0(Native Method)
        at java.net.DualStackPlainSocketImpl.socketBind(DualStackPlainSocketImpl.java:106)

Further investigation found that port 8005 was being used by SCCM, because the NSP Manager service could not bind to the port it just stopped.

The Network Security Platform Best Practices guide has the following;

8005 - Used by the Manager to receive shutdown instructions.    Internal to the Manager.

I'm looking at option for a permanent solution

Regards

Peter Mason

[fkazi04]

NSM Service will fail to start if any required ports are being used. I would suggest you have a dedicated server for NSM. 

Regards,

Faizan

[petermason]

Hi Faizan,

The servers are dedicated for NSM. 

SCCM is a Microsoft product installed for patch management on the host server.

Regards

Peter Mason

[Aoc]

I don't see port 8005 listed in the designated list in the above link. Where is this documented?

[Aoc]

If NSP should be using 85xx I'm wondering how 8005 got into our configuration.

[fkazi04]

Hi Peter,

I would suggest you stop SSCM and start manager service; then start SSCM again. This step should start the manager service and later try starting SSCM. 

Regards,

Faizan