Which services are exposed on the fleet?
SiteAudit checks managed devices for open network services, helping teams distinguish expected print traffic from exposure that deserves a closer look.
Default Security Ports
SiteAudit checks the following ports by default during security assessments:
| Port | Protocol / Service | Risk If Open |
|---|---|---|
| 20, 21 | FTP Data / Control | Unencrypted file transfer; credential exposure |
| 22 | SSH | Remote shell access; brute-force target |
| 23 | Telnet | Plaintext remote access; deprecated |
| 25 | SMTP | Open relay potential; spam vector |
| 53 | DNS | Unusual on printers; may indicate misconfiguration |
| 80 | HTTP (EWS) | Unencrypted web admin interface |
| 110 | POP3 | Unencrypted email retrieval |
| 137, 139 | NetBIOS | Windows file sharing; SMB enumeration risk |
| 443 | HTTPS | Check TLS version and certificate validity |
| 445 | SMB | EternalBlue and related exploit surface |
| 631 | IPP / IPPS | Internet Printing Protocol |
| 995 | POP3S | Encrypted email; check if necessary |
| 5900, 5901 | VNC | Remote desktop; high risk if exposed |
| 8080, 8443 | HTTP/S Alternate | Secondary web interfaces |
| 9100 | RAW / JetDirect | Direct print access; no auth by default |
| 65002 | Proprietary | Non-standard port; warrants investigation |
Viewing Security Scan Results
Security port data is available in several places within SiteAudit:
- Device Detail view — open any device and select the Security tab to see which ports were found open on that device.
- Security Report — run from the Reports menu; shows all devices with open ports, sortable by risk level.
- Alerts — configure threshold alerts to notify when a new open port is detected on any device.
Customizing the Port List
Administrators can add or remove ports from the security scan:
- Open SiteAudit Viewer and go to Tools > Administration > Security Settings.
- In the Port List section, click Edit.
- Add ports by entering the port number and clicking Add. Remove ports by selecting them and clicking Remove.
- Click Save. Changes take effect on the next scheduled collection cycle.
Note: Port 65002 is a non-standard port used by some HP and Xerox devices for internal diagnostics. Its presence alone is not necessarily a risk, but it should be investigated if found open on devices not manufactured by those vendors.
Security Scan Frequency
By default, SiteAudit performs security port scans on the same schedule as the main collection cycle (every 15 minutes for online devices). You can configure a separate, less-frequent schedule for security scans under Administration > Collection Settings to reduce network impact.