AnsweredAssumed Answered

statmonservice alerts 'request from an unauthorized client'

Question asked by Martin Hammond on Oct 16, 2015

Does anyone have an issue with Qualys Scanners generating a flood of alerts on EMC NAS devices? is there a solution other than not scanning the 7777 port?

 

I Found this on the EMC support site:

"

The statmonService runs on the Data Mover, and it listens on port 7777.  The service is used to transport Data Mover statistics to the CS.  By default, the service only accepts requests on the private internal network interface (mge0).  The error means that the IP address indicated is attempting to communicate with the Data Mover on port 7777 on an interface other than mge0.

 

Some service you have running on your Domain Controller is attempting this communication.  If this happens at a regular interval, a network trace should be able to tell you what is being requested and by whom.

 

You could also try firewalling that port and see if any programs on your network complain (they shouldn't; it's only used internally on the Celerra).
"

Outcomes