Firewall Ports Required by Symantec AntiVirus 10

The following ports must be open in order for this program and LiveUpdate to work correctly:

• TCP port 38293 -- Intel PDS listening for ping packets (scope can be limited to subnet: 152.1.3.0 )
• TCP port 2967 -- RTVScan request to Winsock (scope can be limited to subnet:152.1.3.0 )
• TCP ports 1024 through 1030 and 4095 through 5000 (scope can be limited to subnet: 152.1.3.0 )
• TCP ports 80, 21 and 443 -- LiveUpdate

Technical Details

Intel PDS Service
Intel PDS Service is a part of Symantec AntiVirus running on Windows 2000, 2003 or XP. It listens on port 38293/TCP for ping packets from servers and responds with a pong packet containing information on how to communicate with RTVScan. This port value cannot be configured.

RTVScan
RTVScan makes a request to Winsock for port 2967/TCP for IP. This value can be configured by using the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\INTEL\LANDesk\VirusProtect6\CurrentVersion\AgentIPPort
If the request for the static port fails, then RTVScan will use a dynamic port that will be assigned by Winsock and that may be different each time a port is requested.

LiveUpdate

• requires access to ports 80(HTTP), 21(FTP) and 443(HTTPS)
• uses TCP protocol
• accesses the Internet with Lucomserver.exe (in C:\Program Files\Symantec\LiveUpdate)
• accesses these domains:
  • HTTP: symantec.com, symantecliveupdate.com, akamai.net
  • FTP: speedera.net

Msgsys (optional service)
Msgsys generates and sends configured Alert Management System (AMS) alerts. It uses ports 38037 and 38292 for both TCP and UDP communication.

For more information, see this Symantec document:
Windows XP or Windows Server 2003 firewall prevents remote installation

Content updated January 23, 2007 by jrw
Page last modified January 23, 2007 by cawalker