Ports
Reference for configuring your network. Only what you use; defaults can be changed in vScope or your proxies.
Inbound to vScope (UI & proxy)
Section titled “Inbound to vScope (UI & proxy)”| Service | Port | Notes |
|---|---|---|
| Browser access (web UI) | TCP 80 | Default; configurable during installation |
| Proxy traffic to main server | TCP 4445 | Default; configurable during installation. Proxies initiate the connection |
In the Docker image, the web UI listens on port 80 inside the container. Listening on port 80 without root requires a user namespace or the net.ipv4.ip_unprivileged_port_start sysctl; see Run vScope in Kubernetes with restricted privileges.
Outbound from vScope (updates, licensing)
Section titled “Outbound from vScope (updates, licensing)”For automatic updates, license verifications and support communications, vScope requires internet access to the following services.
| Service | URL | Port |
|---|---|---|
| License & Billing | https://account.vscope.net | TCP 443 |
| Software Updates | https://dist.vscope.net (CDN) | TCP 443 |
| Report Bug/Secure Upload | https://status.vscope.net | TCP 443 |
| Email (for setup only Mailgun SMTP) | smtp.mailgun.org | TCP 587 |
For a secure connection, allow outgoing access to the above URLs and ports. vScope can also be operated completely offline within an isolated network.
Discovery: Optional target identification scan
Section titled “Discovery: Optional target identification scan”vScope can probe common ports to find targets. Disable if not desired: Disabling port scan.
Ports checked:
| Port | Protocol | Service |
|---|---|---|
| 22 | TCP | SSH |
| 80 | TCP | HTTP |
| 135 | TCP | RPC |
| 139 | TCP | NetBIOS |
| 443 | TCP | HTTPS |
| 445 | TCP | SMB |
| 8080 | TCP | HTTP (alternative) |
| 1433 | TCP | Microsoft SQL |
| 3306 | TCP | MySQL |
| 3389 | TCP | RDP |
| 5985 | TCP | WS-Management / PowerShell HTTP |
| 5986 | TCP | WS-Management / PowerShell HTTPS |
Data Collection: probes (Popular)
Section titled “Data Collection: probes (Popular)”Common probes and their default ports. Adjust if your environment uses custom ports. For datasource-specific nuances, see the respective datasource pages.
| Probe / Datasource | Default ports | Notes |
|---|---|---|
| HTTP/HTTPS | 80, 8080, 443, 8443 | Generic web targets |
| SSH | 22 | Linux/Unix shells |
| PowerShell | 5985 (HTTP), 5986 (HTTPS) | Windows via PowerShell |
| WinRM | 5985 (HTTP), 5986 (HTTPS) | Windows via PowerShell |
| WMI | 135 + dynamic 49152–65535 (old: 445/139, 1025–5000) | Fix port if needed; see MS link below |
| LDAP/LDAPS | 389/ 636 (StartTLS on 389/636) | Active Directory/LDAP |
| Microsoft SQL Server | 1433, 1434 UDP (browser), custom dynamic for named instances | See SQL datasource |
| MySQL | 3306 | |
| VMware | 443 | vCenter/ESXi |
| Hyper-V | 5985/5986 | |
| SNMP | 161 UDP (10161 for secure SNMPv3) | |
| AWS / Azure APIs | 443 (outbound) |
For details on configuring fixed ports for WMI, refer to Microsoft Learn: Setting Up a Fixed Port for WMI.
Azure RM endpoints
Section titled “Azure RM endpoints”The vScope server or discovery proxy performing Azure discovery must have outbound HTTPS access (TCP port 443) to the required Microsoft endpoints below.
| Microsoft service | Endpoint | Port |
|---|---|---|
| Microsoft Defender for Endpoint | api-eu.securitycenter.microsoft.com | TCP 443 |
| Azure Resource Manager | management.azure.com | TCP 443 |
| Microsoft Entra ID and Intune (Microsoft Graph) | graph.microsoft.com | TCP 443 |
| Microsoft authentication | login.microsoftonline.com | TCP 443 |