Forum Discussion
CodnChips
Oct 10, 2022Brass Contributor
Defender Remote Port Connection Sequence
Why does Defender regularly attempt to connect devices within the same subnet, using this port sequence: 106, 111, 515, 623, 660, 808, 1433, 1434, 1521, 1720, 2049, 2869, 3283, 3306, 5040, 5357, 500...
- Oct 10, 2022Could be this feature
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide
StephanGee
Oct 10, 2022Iron Contributor
Could be this feature
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-discovery?view=o365-worldwide
CodnChips
Oct 11, 2022Brass Contributor
Yeah that's it - I've mapped the ports to the services and it makes sense, looking at the variety of services it attempts to "discover".