Ports & network reference

Skans runs a whole enclave from one box, so most of its traffic is between the appliance and the devices it manages. This page maps each service to its port, protocol, and direction relative to the Skans appliance — what an operator browser reaches, what managed devices connect into, and what never leaves the box at all.

Two tiers below separate what the Skans spec pins down from what follows each protocol’s well-known default. Treat the first table as authoritative and the second as “confirm against your installer config.”

The communication map #

flowchart LR
  op["Operator<br/>browser"]:::ext
  ag["Windows<br/>agents"]:::ext
  ed["Edges<br/>(other sites)"]:::ext
  dv["Cameras · IoT · OT"]:::ext

  subgraph app["Skans appliance"]
    direction TB
    cp["ControlPlane<br/>console"]:::core
    ah["Agent Hub"]:::gw
    ew["Edge Wire"]:::gw
    co["Collector"]:::gw
    ls[("OpenSearch · Vault · SQL<br/>loopback only")]:::store
  end

  op -->|"HTTPS :7328"| cp
  ag -->|"mTLS :7326"| ah
  ed -->|"mTLS :7327"| ew
  dv -. "syslog :514 · SNMP :161/162" .-> co
  ah --> ls
  ew --> ls
  co --> ls
  cp --> ls

  classDef ext fill:#0e1420,stroke:#5e6b7d,color:#98a4b3;
  classDef core fill:#122a4a,stroke:#38bdf8,stroke-width:2px,color:#f4f7fb;
  classDef gw fill:#121826,stroke:#34d3c1,color:#f4f7fb;
  classDef store fill:#121826,stroke:#8b8cf6,color:#f4f7fb;

Only three ports face the network — the two mutual-TLS gateways (7326 agents, 7327 edges) and the HTTPS console (7328). The stores are loopback-only; the device lane is UDP.

Documented in the Skans spec #

These ports are named explicitly in the Skans service and architecture docs. They are what you plan firewall rules around for a single self-contained appliance.

Standard defaults (not enumerated in the Skans spec) #

These services are shipped and named in the docs, but the source files give the service, not a port number. The numbers below are each protocol’s IANA / well-known default — correct in practice, but you should confirm them against the running installer configuration rather than treat them as spec-quoted.

Two monitoring lanes #

The split between the agent lane and the agentless lane is an architectural invariant, and it maps directly onto the ports above:

• Agent-managed (Windows endpoints) push over the 7326 mTLS hub. Windows event collection rides this lane end to end.
• Agentless (IoT / OT / network devices) flow through the SkansCollector lanes — syslog 514, SNMP trap 162, and outbound SNMP poll.

Windows endpoints are never SNMP-polled; SNMP is only ever used for IoT / OT and network gear. See Install & approve the Windows agent and Enroll a device for the two paths.

Loopback and never-exposed services #

The on-box search store and its dashboards are loopback-only by design. The browser never talks to OpenSearch directly — the console on 7328 reverse-proxies the dashboards, so 7328 is the only web port an operator’s browser ever reaches. The internal core API between the low-privilege workers and the trusted core likewise rides a named pipe / loopback mTLS channel with no TCP port.

Next #

• Requirements — the network and platform a site needs before install
• Install & approve the Windows agent — the 7326 agent lane
• Troubleshooting — when a service or listener isn’t reachable