ARDAgent Attacking Firewall Port

Question

Level 1

0 points

ARDAgent Attacking Firewall Port

Why is my ARDAgent keep sending trying to open up port(s) on my firewall (172.20.1.9) multiple time per minutes. It won't stop until reboot.

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

ARDAgent 136 nobody 11u IPv4 0x9f2151a73c1fde49 0t0 TCP 172.20.181.18:55202->172.20.1.9:10586 (SYN_SENT)

ARDAgent 136 nobody 16u IPv4 0x9f2151a739428631 0t0 TCP 172.20.181.18:55203->172.20.1.9:10586 (SYN_SENT)

ARDAgent 136 nobody 25u IPv4 0x9f2151a73b004631 0t0 TCP 172.20.181.18:55212->172.20.1.9:10586 (SYN_SENT)

iMac, OS X Mavericks (10.9.4), Apple Remote Desktop 3.7.1 Client

Posted on Jul 2, 2015 12:12 PM

Reply

Answer 1

Jul 6, 2015 12:16 PM in response to CronMaster

This looks like normal behaviour because I see this whenever Remote Management is enabled. What I don't see is the agent trying to open ports in my firewall. By firewall I don't mean the one built into OS X. Seeing as this forum is for the administrator part of Apple Remote Desktop (ARD) then my question to you is: "do you have a specific need to have Remote Management enabled for your mac?" If the answer is no then disable it using the Sharing Preferences Pane.

Reply

Answer 2

CronMaster Author

Level 1

0 points

Aug 21, 2015 1:27 PM in response to Antonio Rocco

We have 1000 iMacs, Macbooks, etc to manage. Therefore we need to use Remote Desktop.

Reply

Answer 3

Aug 24, 2015 3:23 AM in response to CronMaster

OK.

Do you see this on all 1000 macs or just your Mac?

Reply