Ports in Searches

The system accepts specific syntax for port numbers in searches. You can enter:

  • a single port number

  • a comma-separated list of port numbers

  • two port numbers separated by a dash to represent a range of port numbers

  • a port number followed by a protocol abbreviation, separated by a forward slash (only when searching for intrusion events)

  • a port number or range of port numbers preceded by an exclamation mark to indicate a negation of the specified ports

Note

Do not use spaces when specifying port numbers or ranges.

Port Syntax Examples

Example

Description

21

Returns all events on port 21, including TCP and UDP events.

!23

Returns all events except those on port 23.

25/tcp

Returns all TCP-related intrusion events on port 25.

21/tcp,25/tcp

Returns all TCP-related intrusion events on ports 21 and 25.

21-25

Returns all events on ports 21 through 25.