TCP 17778
Synopsis
- TCP port 17778 is used by the SolarWinds Platform (formerly Orion), specifically for the SolarWinds Information Service (SWIS) API over HTTPS. SolarWinds modules such as Network Performance Monitor (NPM), Server & Application Monitor (SAM), and Network Configuration Manager (NCM) access the SWIS/Orion API via 17778 for management and data queries. The SolarWinds Agent also communicates with the SolarWinds server/polling engine over TCP 17778 (TLS) in agent-initiated mode for tasking and data transfer. This port has been associated with exploitation: CVE-2020-10148 (an authentication bypass in the Orion API reachable on 17778) was exploited in the wild during the broader 2020 SolarWinds compromises.
Observed activity
Last 30 days
Detailed chart