Firewall Ports Required by Symantec AntiVirus 8 and 9

The following ports must be open in order for these programs and LiveUpdate to work correctly:

• UDP port 38293 -- Intel PDS listening for ping packets
• UDP port 2967 -- RTVScan request to Winsock
• TCP ports 80, 21 and 443 -- LiveUpdate

Technical Details

Intel PDS Service
Intel PDS Service is a part of Symantec AntiVirus running on Windows NT, 2000 or XP. It listens on port 38293/UDP for ping packets from servers and responds with a pong packet containing information on how to communicate with RTVScan. This port value cannot be configured.

RTVScan
RTVScan makes a request to Winsock for port 2967/UDP for IP. This value can be configured by using the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\AgentIPPort
If the request for the static port fails, then RTVScan will use a dynamic port that will be assigned by Winsock and that may be different each time a port is requested.

LiveUpdate

• requires access to ports 80 (HTTP), 21 (FTP) and 443 (HTTPS)
• uses TCP protocol
• accesses the Internet with Lucomserver.exe (in C:\Program Files\Symantec\LiveUpdate)
• accesses these domains:
  • HTTP: symantec.com, symantecliveupdate.com, akamai.net
  • FTP: speedera.net

Msgsys (optional service)
Msgsys generates and sends configured Alert Management System (AMS) alerts. It uses ports 38037 and 38292 for both TCP and UDP communication.

For more details, see these Symantec documents:
Ports used for communication in Symantec AntiVirus Corporate Edition 8.x and 9.x
Can Windows XP Internet Connection Firewall prevent clients from receiving virus definitions updates?
Windows XP or Windows Server 2003 firewall prevents remote installation

Content updated January 23, 2007 by jrw
Page last modified January 23, 2007 by cawalker