This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intermittent disconnected servers in Entreprise Console

Hello All,

Our environment contains one SEC 5.5.1 with server 2016, and is mainly use to protect Windows Server (2008R2, 2012R2,2016)

We are facing issues to have all servers connected to our console, numbers will go up and suddenly drop, and start to go up again

We have about 900 endpoints, where at max i will say we can see 300 connected all the rest is disconneted

On the SEC router log file we have many entries with

error code: 336462231 - error:140E0197:SSL routines:SSL_shutdown:shutdown while in init

I am assuming that all those actions are bring down the router service and that is why numbers dont go up and stay stable.

On the client side i can find various errors

19.05.2020 10:15:54 166C E ACE_SSL (5664|5740) error code: 336027804 - error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request

some with

19.05.2020 15:41:38 AED8 E ParentLogon::RegisterParent: Caught CORBA system exception, ID 'IDL:omg.org/CORBA/TRANSIENT:1.0'
OMG minor code (2), described as '*unknown description*', completed = NO

Clients will get connected and the suddenly disconnected for some hours, and then comeback online.

Help and guidance, to where to start looking will be appreciated
I am not sure all servers are afected in the same way

Thanks in advance
Carlos

This thread was automatically locked due to age.

Parents

0 jak over 4 years ago

On the management server, does it perform any other roles that could cause a lot of TCP connections? Could it be running out of ephemeral ports and having to recycle them?

This seems unlikely on a 2016 server though and you would get a Windows event log entry for this, that said you could run:

netsh int ipv4 show dynamicport tcp

This will print the starting port in the dynamic (ephemeral) range and how many ports there can be. What does that look like?

If when connections are being closed, what does

netstat.exe -ano | find.exe "ESTABLISHED" /c

return for the number of established TCP connections? Does this approach the limit of ephemeral ports as a guide?

Thanks,

Jak
Cancel
Vote Up 0 Vote Down

Cancel
0 Carlos Fernandez1 over 4 years ago in reply to jak

Hi Jak

TCP dynamics looks like this

Protocol tcp Dynamic Port Range
---------------------------------
Start Port : 49152
Number of Ports : 16384

and the Netstat returned 438, when I ran the command there was only 84 connected servers to the console

What I dont really get is why a server which is connected, would suddenly drop when nothing as change, even trying to restart the service "router" on the endpoint does not always re-connect the endpoint.

Hope this info helps a bit

Regards,

Carlos
Cancel
Vote Up 0 Vote Down

Cancel
0 jak over 4 years ago in reply to Carlos Fernandez1

Can you export the router reg key: HKLM\SOFTWARE\Wow6432Node\Sophos\Messaging System\Router\ to a .reg/txt and paste it here?

Thanks.
Cancel
Vote Up 0 Vote Down

Cancel

0 Carlos Fernandez1 over 4 years ago in reply to jak

Fullscreen SEC_router_key.txt Download

Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Messaging System\Router
Class Name:        <NO CLASS>
Last Write Time:   18.05.2020 - 21:56
Value 0
  Name:            LegacyProtocolSupport
  Type:            REG_DWORD
  Data:            0

Value 1
  Name:            <NO NAME>
  Type:            REG_SZ
  Data:            

Value 2
  Name:            NumORBThreads
  Type:            REG_DWORD
  Data:            0x10

Value 3
  Name:            ParentAddress
  Type:            REG_SZ
  Data:            

Value 4
  Name:            ParentPort
  Type:            REG_DWORD
  Data:            0x2000

Value 5
  Name:            ConnectionCache
  Type:            REG_DWORD
  Data:            0x5020

Value 6
  Name:            NumSenderThreads
  Type:            REG_DWORD
  Data:            0x8

Value 7
  Name:            ConnectRetriesPause
  Type:            REG_DWORD
  Data:            0x64

Value 8
  Name:            TotalConnectRetryTimeSecs
  Type:            REG_DWORD
  Data:            0xa

Value 9
  Name:            GetterInterval
  Type:            REG_DWORD
  Data:            0x78

Value 10
  Name:            GetterShortInterval
  Type:            REG_DWORD
  Data:            0x78

Value 11
  Name:            NumNotificationThresholdThreads
  Type:            REG_DWORD
  Data:            0x4

Value 12
  Name:            IORSenderPort
  Type:            REG_DWORD
  Data:            0x2000

Value 13
  Name:            ServiceArgs
  Type:            REG_SZ
  Data:            -ORBListenEndpoints iiop://10.137.249.17:8193/ssl_port=8194

Value 14
  Name:            NotifyRouterUpdate
  Type:            REG_SZ
  Data:            EM

Value 15
  Name:            NotifyClientUpdate
  Type:            REG_SZ
  Data:            Router$esopvm1041.Agent

Value 16
  Name:            HostIPToParent
  Type:            REG_DWORD
  Data:            0

Value 17
  Name:            ServiceHomeDir
  Type:            REG_SZ
  Data:            E:\Sophos\Enterprise Console\Remote Management System\

Value 18
  Name:            ServiceDescription
  Type:            REG_SZ
  Data:            Message router for Sophos applications


Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Messaging System\Router\Private
Class Name:        <NO CLASS>
Last Write Time:   18.05.2020 - 19:50
Value 0
  Name:            pkp
  Type:            REG_BINARY
  Data:            
00000000   00 08 c0 c6 49 bd 12 06 - 4d 7c c1 98 70 50 4c 84  ..ÀÆI½..M|Á.pPL.
00000010   fe 7f a2 5c e9 9d 6a 9d - e2 08 a4 36 92 48 98 3d  þ.¢\é.j.â.¤6.H.=
00000020   a6 31 2e 8a 06 0c c3 af - 6e 57 00 fc eb e2 2b 00  ¦1....Ã¯nW.üëâ+.
00000030   dc 65 cc 8e 4a 67 09 15 - 56 2e eb 9e 4a c9 d5 c8  ÜeÌ.Jg	.V.ë.JÉÕÈ
00000040   f6 e1 c5 7e 7a 47 c4 a2 - bc 5f ea 77 78 f0 08 e1  öáÅ~zGÄ¢¼_êwxð.á
00000050   57 c1 4c 72 a4 15 3f 1a - 8a 66 c2 0c a5 25 02 57  WÁLr¤.?..fÂ.¥%.W
00000060   90 a4 57 40 88 ea d3 26 - e3 8c 36 9a 39 e3 8c 43  .¤W@.êÓ&ã.6.9ã.C
00000070   60 4e f1 7a 73 2f 3d 22 - 9a 95 cc cd 42 f8 a6 b7  `Nñzs/="..ÌÍBø¦·
00000080   28 b9 07 a6 fb 57 bc 93 - b6 1c f6 67 aa 3b a8 c4  (¹.¦ûW¼.¶.ögª;¨Ä
00000090   21 29 5e 65 3d a6 26 23 - 10 db 1e 23 58 1b 7f 67  !)^e=¦&#.Û.#X..g
000000a0   3a d5 de f8 d4 5d 60 85 - fd 49 ec 52 c7 76 fa 1e  :ÕÞøÔ]`.ýIìRÇvú.
000000b0   4b d1 78 55 4b 01 7d cb - e2 ac 8a d4 a7 04 6c 42  KÑxUK.}Ëâ¬.Ô§.lB
000000c0   bf 2d e4 67 c4 78 59 ec - 28 cc dc 79 03 db dd d0  ¿-ägÄxYì(ÌÜy.ÛÝÐ
000000d0   2c f4 ad 7c 95 4c 3b 41 - 01 d2 d1 e2 9a 3b 4c 0d  ,ô|.L;A.ÒÑâ.;L.
000000e0   87 57 1c e8 f8 b2 9c c3 - bd 65 3a 09 b8 d6 b7 ed  .W.èø².Ã½e:	¸Ö·í
000000f0   86 af 75 b8 16 77 d3 eb - 12 99 88 14 51 d8 72 31  .¯u¸.wÓë....QØr1
00000100   7d 66 c8 e4 06 24 bd ec - 6f 03 9c e3 48 df 50 da  }fÈä.$½ìo..ãHßPÚ
00000110   b1 3e 2f 53 2c ea 27 7e - 2a 57 eb aa 6b 33 43 84  ±>/S,ê'~*Wëªk3C.
00000120   1d 8d 71 d7 37 87 5e 76 - dd 93 3a bd 69 76 6f 2b  ..q×7.^vÝ.:½ivo+
00000130   90 0a 07 ad 5e 4e db b8 - 38 f1 50 2e 08 b2 72 ce  ...^NÛ¸8ñP..²rÎ
00000140   14 f6 e7 85 f5 de a3 dd - 92 c4 56 95 da 78 74 fd  .öç.õÞ£Ý.ÄV.Úxtý
00000150   60 9e 07 e1 0f 3d 06 41 - 0e 90 62 85 98 3c d1 9b  `..á.=.A..b..<Ñ.
00000160   6b c2 61 72 16 27 ec 73 - b3 9c c3 09 da 64 f3 02  kÂar.'ìs³.Ã	Údó.
00000170   e2 6f ce 31 7e fa e9 50 - 62 94 b7 1e a7 53 0f e3  âoÎ1~úéPb.·.§S.ã
00000180   d4 76 97 20 fe 60 8a 4c - f8 b9 a4 f6 d6 e6 82 6d  Ôv. þ`.Lø¹¤öÖæ.m
00000190   dd 74 0f 87 1c ce 95 bb - 1e c4 60 12 e1 35 17 3f  Ýt...Î.».Ä`.á5.?
000001a0   f4 64 7f 7c bd 4c 04 fb - 9f 8c 06 67 18 8a 16 8c  ôd.|½L.û...g....
000001b0   4e 61 8f 79 34 16 cf f1 - 35 52 65 47 09 1c 93 49  Na.y4.Ïñ5ReG	..I
000001c0   1e 81 fc 21 35 37 5f 1b - 17 2f 9c 04 ed ca 2e de  ..ü!57_../..íÊ.Þ
000001d0   84 79 85 ed bc 79 f4 73 - 6b ba b3 35 90 46 02 86  .y.í¼yôskº³5.F..
000001e0   63 8e c1 3c 5e 7a 87 47 - 6a 3b 42 87 36 d9 06 a9  c.Á<^z.Gj;B.6Ù.©
000001f0   0d 68 21 98 39 2c f7 ee - ee 90 68 89 f6 8d 46 60  .h!.9,÷îî.h.ö.F`
00000200   36 1f f2 ba ce 5f 92 af - 73 db 6d 86 28 05 4a 4c  6.òºÎ_.¯sÛm.(.JL
00000210   2e e3 b6 02 0c b6 92 1f - 77 22 b0 9d 91 4a 3b 78  .ã¶..¶..w"°..J;x
00000220   64 7a 78 ae 59 7b 45 33 - a2 85 47 27 39 8e 44 03  dzx®Y{E3¢.G'9.D.
00000230   12 1f 1f e5 9e 6c 04 8c - c8 7c 5d d2 c3 c0 7c 49  ...å.l..È|]ÒÃÀ|I
00000240   56 6c f9 9e 78 e1 d3 ab - 0c a9 58 41 9a 8f 32 e3  Vlù.xáÓ«.©XA..2ã
00000250   99 c6 ed 90 14 e5 3e d1 - 42 44 55 ed 5f c2 68 81  .Æí..å>ÑBDUí_Âh.
00000260   20 18 51 f6 47 58 1e 0c - a8 cd 85 09 c6 8e 5f d0   .QöGX..¨Í.	Æ._Ð
00000270   f7 9e 7e d6 38 fc 0f 99 - 9a 81 1f d1 1e 07 37 23  ÷.~Ö8ü.....Ñ..7#
00000280   cf b0 14 ab 23 ee 14 8a - 01 7b dc 46 19 13 d8 26  Ï°.«#î...{ÜF..Ø&
00000290   77 d1 c4 d7 9a 24 8f a2 - 87 64 fa 26 d0 63 cb 92  wÑÄ×.$.¢.dú&ÐcË.
000002a0   a3 04 bc 1a 1e 54 85 92 - 4d 74 3e 36 7f 20 72 e5  £.¼..T..Mt>6. rå
000002b0   e4 1d 74 35 74 d1 e9 80 - 7c b6 99 32 11 8a 9d 4f  ä.t5tÑé.|¶.2...O
000002c0   73 da 78 f5 7b 58 4a 81 - b6 dc 32 6c 49 0b 3b cb  sÚxõ{XJ.¶Ü2lI.;Ë
000002d0   5d bc 30 0c e0 1a 89 ee - 12 8f 55 e4 96 a1 10 cc  ]¼0.à..î..Uä.¡.Ì
000002e0   cb 13 a4 c9 ff 3a e8 d7 - a6 9d 55 11 51 df bc 5e  Ë.¤Éÿ:è×¦.U.Qß¼^
000002f0   6d 99 7c 06 0f d2 62 e6 - b0 f1 ce 79 96 a4 69 e3  m.|..Òbæ°ñÎy.¤iã
00000300   35 12 f2 42 76 18 8f 4b - 18 77 63 ce 68 87 e2 06  5.òBv..K.wcÎh.â.
00000310   57 68 fb 49 dd 22 be b2 - 5d 0c 2f 38 bc b0 fa e6  WhûIÝ"¾²]./8¼°úæ
00000320   e4 1d 71 aa 05 f4 75 44 - 9a 53 2f 77 db 08 e6 f6  ä.qª.ôuD.S/wÛ.æö
00000330   ee eb b0 ed ce ce a5 7b - 54 7a 64 a7 81 7c 34 4f  îë°íÎÎ¥{Tzd§.|4O
00000340   fb 96 a3 88 3e 93 2e 41 - c2 a5 e7 26 8d 90 6a d9  û.£.>..AÂ¥ç&..jÙ
00000350   8c 53 da 8a ad 0d d2 59 - 34 6d 0a e8 5a 73 4d a2  .SÚ..ÒY4m.èZsM¢
00000360   53 0c 93 cf 31 80 25 5d - f7 ad b6 24 ad e3 bf e5  S..Ï1.%]÷¶$ã¿å
00000370   c3 e9 94 a5 02 fd c8 3d - a7 ac 5e 2e 32 64 84 1c  Ãé.¥.ýÈ=§¬^.2d..
00000380   23 d4 1a 46 91 4f f7 8e - ad ec 4f e8 81 6c be 37  #Ô.F.O÷.ìOè.l¾7
00000390   85 9f a3 4a 53 1b f4 8f - 3f 6d 5d 88 93 1d a4 b2  ..£JS.ô.?m]...¤²
000003a0   21 f3 94 da 52 d7 6c 09 - 49 dd 67 91 7c 06 ee 76  !ó.ÚR×l	IÝg.|.îv
000003b0   fc 17 dd 06 d5 d8 1f 67 - dc 82 4e ba 28 79 73 b7  ü.Ý.ÕØ.gÜ.Nº(ys·
000003c0   83 09 00 39 2f a1 9a 68 - d3 6b 90 a2 b6 ae 3d 37  .	.9/¡.hÓk.¢¶®=7
000003d0   06 0e fb 65 f7 63 52 fd - ab e7 f6 3f 84 e5 40 e3  ..ûe÷cRý«çö?.å@ã
000003e0   52 95 8a 3f 3e 35 cd 4d - 07 d5 df 79 5b 93 74 00  R..?>5ÍM.Õßy[.t.
000003f0   61 a0 de 42 2f 54 44 0b - f7 a6 8c 55 43 c3 50 3c  a ÞB/TD.÷¦.UCÃP<
00000400   4c de 20 00 20 fd 08 f6 - e1 53 e7 92 ec 42 b0 16  LÞ . ý.öáSç.ìB°.
00000410   ca fe f7 26 c4 2d 12 1a - a2 56 02 2b a6 e1 5a 72  Êþ÷&Ä-..¢V.+¦áZr
00000420   bb 4a 07 82 1a bc b6 6f - bd 0a cf b2 4c d8 a1 24  »J...¼¶o½.Ï²LØ¡$
00000430   20 6b 03 d8 66 ea b7 08 - 83 23 7e 48 ae e7 ac 64   k.Øfê·..#~H®ç¬d
00000440   79 3c bb f6 72 a6 7c bc - fb 2b c3 4e 25 a4 c1 51  y<»ör¦|¼û+ÃN%¤ÁQ
00000450   b2 56 32 3b cf 4a fb dd - f7 e9 83 16 3e b5 00 b8  ²V2;ÏJûÝ÷é..>µ.¸
00000460   7a 51 f3 55 b1 15 f1 8a - e8 38 18 4c 19 5c 80 52  zQóU±.ñ.è8.L.\.R
00000470   e8 e1 b5 66 6c bc f0 a3 - 08 9f 8d b9 b8 7d 2b 98  èáµfl¼ð£...¹¸}+.
00000480   09 20 48 da ac f3 8e 62 - 32 b9 f2 63 1f b2 f4 dc  	 HÚ¬ó.b2¹òc.²ôÜ
00000490   2e 1b 9f 4a 70 84 4a a6 - 85 17 db 3d c4 48 f7 e1  ...Jp.J¦..Û=ÄH÷á
000004a0   92 69 b7 eb aa d6 99 7d - e7 fc 76 85 f6 17 92 a8  .i·ëªÖ.}çüv.ö..¨
000004b0   7f 95 71 5e be 8b 32 ce - 83 c3 80 6b 9d 2a cb 15  ..q^¾.2Î.Ã.k.*Ë.
000004c0   fa ed                                              úí

Value 1
  Name:            pkc
  Type:            REG_BINARY
  Data:            
00000000   30 82 03 29 30 82 02 11 - a0 03 02 01 02 02 03 04  0..)0... .......
00000010   1e d2 30 0d 06 09 2a 86 - 48 86 f7 0d 01 01 0b 05  .Ò0..	*.H.÷.....
00000020   00 30 11 31 0f 30 0d 06 - 03 55 04 03 0c 06 45 4d  .0.1.0...U....EM
00000030   32 5f 43 41 30 1e 17 0d - 32 30 30 35 30 36 31 31  2_CA0...20050611
00000040   32 39 33 37 5a 17 0d 34 - 30 30 35 30 32 31 31 32  2937Z..400502112
00000050   39 33 37 5a 30 1c 31 1a - 30 18 06 03 55 04 03 0c  937Z0.1.0...U...
00000060   11 52 6f 75 74 65 72 24 - 65 73 6f 70 76 6d 31 30  .Router$esopvm10
00000070   34 31 30 82 01 22 30 0d - 06 09 2a 86 48 86 f7 0d  410.."0..	*.H.÷.
00000080   01 01 01 05 00 03 82 01 - 0f 00 30 82 01 0a 02 82  ..........0.....
00000090   01 01 00 be 68 d4 cb 19 - 77 17 f8 6a 85 b9 7e df  ...¾hÔË.w.øj.¹~ß
000000a0   4d 9d e3 2a 21 21 10 1a - 8f fb e2 59 c8 4c 89 a4  M.ã*!!...ûâYÈL.¤
000000b0   ba c3 2b 9d 5e f0 4b 95 - ce 7f 02 a7 e0 96 4e 89  ºÃ+.^ðK.Î..§à.N.
000000c0   56 97 71 8b e5 e9 78 60 - 3c 76 e3 9d 5f a5 86 18  V.q.åéx`<vã._¥..
000000d0   02 c2 52 b1 8e 3a a1 50 - cb 2b ca 52 e4 56 bd b6  .ÂR±.:¡PË+ÊRäV½¶
000000e0   69 e5 c0 ea e1 ac d9 91 - a1 10 82 66 4f 7d ed d5  iåÀêá¬Ù.¡..fO}íÕ
000000f0   bb 13 e8 96 63 11 75 03 - ef d3 07 1d 85 b4 8c 13  ».è.c.u.ïÓ...´..
00000100   2a 1f e2 90 d6 fe 1a 83 - eb 8c c0 f6 ca a7 2a d6  *.â.Öþ..ë.ÀöÊ§*Ö
00000110   82 c9 9f 7f 10 d8 fa a7 - d3 a5 db 49 5a 82 06 6f  .É...Øú§Ó¥ÛIZ..o
00000120   66 67 1f 05 9f 46 9f 38 - b2 94 f8 ad c1 3e cb 0c  fg...F.8².øÁ>Ë.
00000130   a3 bc 44 b4 72 43 37 46 - 62 31 30 27 cb f5 f2 7c  £¼D´rC7Fb10'Ëõò|
00000140   f1 a5 d4 1c 7e 6b a4 f7 - 57 58 e4 97 0f 82 1e 29  ñ¥Ô.~k¤÷WXä....)
00000150   31 d7 6c 0d c7 89 c6 50 - 82 c0 9c 3f 01 61 f3 56  1×l.Ç.ÆP.À.?.aóV
00000160   e5 71 2a 4b c0 a8 4a 50 - c8 2e 82 8a a8 ec 2c 0b  åq*KÀ¨JPÈ...¨ì,.
00000170   09 21 12 7f fe e7 b5 fb - 78 3f e1 1a 14 73 6f d0  	!..þçµûx?á..soÐ
00000180   fc 09 f8 8c 76 0e fa 2f - 78 80 83 e2 a5 fb 67 4a  ü	ø.v.ú/x..â¥ûgJ
00000190   05 02 4b 02 03 01 00 01 - a3 7f 30 7d 30 1d 06 03  ..K.....£.0}0...
000001a0   55 1d 0e 04 16 04 14 7a - 32 f2 72 59 ce 8a 78 ad  U......z2òrYÎ.x
000001b0   46 ba ed e5 9e ad d7 ac - 83 b2 91 30 39 06 03 55  Fºíå.×¬.².09..U
000001c0   1d 23 04 32 30 30 80 14 - bd bd 54 13 cd ab d7 a8  .#.200..½½T.Í«×¨
000001d0   d4 da a4 7c 47 24 62 94 - 37 a3 a9 70 a1 15 a4 13  ÔÚ¤|G$b.7£©p¡.¤.
000001e0   30 11 31 0f 30 0d 06 03 - 55 04 03 0c 06 45 4d 32  0.1.0...U....EM2
000001f0   5f 43 41 82 01 01 30 09 - 06 03 55 1d 13 04 02 30  _CA...0	..U....0
00000200   00 30 0e 06 03 55 1d 0f - 01 01 ff 04 04 03 02 05  .0...U....ÿ.....
00000210   a0 30 06 06 02 77 01 04 - 00 30 0d 06 09 2a 86 48   0...w...0..	*.H
00000220   86 f7 0d 01 01 0b 05 00 - 03 82 01 01 00 3f 1a 63  .÷...........?.c
00000230   be 28 3f 77 c3 b9 9d fd - 68 92 3e 43 58 12 5e 0b  ¾(?wÃ¹.ýh.>CX.^.
00000240   aa f4 32 62 90 92 94 e3 - d8 f4 84 c6 a1 88 a6 2e  ªô2b...ãØô.Æ¡.¦.
00000250   3e f9 79 48 9b dd fd f7 - 49 a0 63 69 69 15 65 d8  >ùyH.Ýý÷I cii.eØ
00000260   72 54 dd 34 4b 7b be f4 - df bc 06 43 80 9e 17 34  rTÝ4K{¾ôß¼.C...4
00000270   eb 89 15 ab 8a ae ab a9 - 00 37 59 b4 9a 27 0f 2b  ë..«.®«©.7Y´.'.+
00000280   15 d4 67 36 c6 95 7a a4 - 79 e3 60 fb c8 5b 9e b0  .Ôg6Æ.z¤yã`ûÈ[.°
00000290   0f dc 8b 92 90 36 e4 e5 - eb 08 79 7f 5f 7d e6 22  .Ü...6äåë.y._}æ"
000002a0   83 0c 29 82 d9 91 14 78 - fd 29 0f 09 63 98 3c e4  ..).Ù..xý).	c.<ä
000002b0   8b 52 02 10 6c 01 f0 bb - 9a 75 ca 70 06 db 45 e0  .R..l.ð».uÊp.ÛEà
000002c0   42 4b dc 65 0c 12 bd 01 - e6 01 07 d0 13 1b a9 04  BKÜe..½.æ..Ð..©.
000002d0   10 e3 6c 10 84 48 1d d1 - fb f6 42 e9 62 d8 c4 0c  .ãl..H.ÑûöBébØÄ.
000002e0   c2 86 8c ae 71 88 f2 66 - 9c 88 75 d1 b9 9e 64 65  Â..®q.òf..uÑ¹.de
000002f0   81 d1 1c 3f 16 c4 fd 80 - 54 2a 4a 4d 0c d5 95 be  .Ñ.?.Äý.T*JM.Õ.¾
00000300   7d d1 22 38 4c 55 fe 8a - ab 0b 23 53 26 91 ad b8  }Ñ"8LUþ.«.#S&.¸
00000310   67 44 fa d9 62 7a 11 fe - 3b c8 8a d4 6f 9f 13 aa  gDúÙbz.þ;È.Ôo..ª
00000320   c2 52 a8 78 47 3f 9f 7f - c3 b9 d1 52 51           ÂR¨xG?..Ã¹ÑRQ

This is the SEC router registry keys, I have added the IP after the iiop:// as part of my tests

Reply

0 Carlos Fernandez1 over 4 years ago in reply to jak

Fullscreen SEC_router_key.txt Download

Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Messaging System\Router
Class Name:        <NO CLASS>
Last Write Time:   18.05.2020 - 21:56
Value 0
  Name:            LegacyProtocolSupport
  Type:            REG_DWORD
  Data:            0

Value 1
  Name:            <NO NAME>
  Type:            REG_SZ
  Data:            

Value 2
  Name:            NumORBThreads
  Type:            REG_DWORD
  Data:            0x10

Value 3
  Name:            ParentAddress
  Type:            REG_SZ
  Data:            

Value 4
  Name:            ParentPort
  Type:            REG_DWORD
  Data:            0x2000

Value 5
  Name:            ConnectionCache
  Type:            REG_DWORD
  Data:            0x5020

Value 6
  Name:            NumSenderThreads
  Type:            REG_DWORD
  Data:            0x8

Value 7
  Name:            ConnectRetriesPause
  Type:            REG_DWORD
  Data:            0x64

Value 8
  Name:            TotalConnectRetryTimeSecs
  Type:            REG_DWORD
  Data:            0xa

Value 9
  Name:            GetterInterval
  Type:            REG_DWORD
  Data:            0x78

Value 10
  Name:            GetterShortInterval
  Type:            REG_DWORD
  Data:            0x78

Value 11
  Name:            NumNotificationThresholdThreads
  Type:            REG_DWORD
  Data:            0x4

Value 12
  Name:            IORSenderPort
  Type:            REG_DWORD
  Data:            0x2000

Value 13
  Name:            ServiceArgs
  Type:            REG_SZ
  Data:            -ORBListenEndpoints iiop://10.137.249.17:8193/ssl_port=8194

Value 14
  Name:            NotifyRouterUpdate
  Type:            REG_SZ
  Data:            EM

Value 15
  Name:            NotifyClientUpdate
  Type:            REG_SZ
  Data:            Router$esopvm1041.Agent

Value 16
  Name:            HostIPToParent
  Type:            REG_DWORD
  Data:            0

Value 17
  Name:            ServiceHomeDir
  Type:            REG_SZ
  Data:            E:\Sophos\Enterprise Console\Remote Management System\

Value 18
  Name:            ServiceDescription
  Type:            REG_SZ
  Data:            Message router for Sophos applications


Key Name:          HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Sophos\Messaging System\Router\Private
Class Name:        <NO CLASS>
Last Write Time:   18.05.2020 - 19:50
Value 0
  Name:            pkp
  Type:            REG_BINARY
  Data:            
00000000   00 08 c0 c6 49 bd 12 06 - 4d 7c c1 98 70 50 4c 84  ..ÀÆI½..M|Á.pPL.
00000010   fe 7f a2 5c e9 9d 6a 9d - e2 08 a4 36 92 48 98 3d  þ.¢\é.j.â.¤6.H.=
00000020   a6 31 2e 8a 06 0c c3 af - 6e 57 00 fc eb e2 2b 00  ¦1....Ã¯nW.üëâ+.
00000030   dc 65 cc 8e 4a 67 09 15 - 56 2e eb 9e 4a c9 d5 c8  ÜeÌ.Jg	.V.ë.JÉÕÈ
00000040   f6 e1 c5 7e 7a 47 c4 a2 - bc 5f ea 77 78 f0 08 e1  öáÅ~zGÄ¢¼_êwxð.á
00000050   57 c1 4c 72 a4 15 3f 1a - 8a 66 c2 0c a5 25 02 57  WÁLr¤.?..fÂ.¥%.W
00000060   90 a4 57 40 88 ea d3 26 - e3 8c 36 9a 39 e3 8c 43  .¤W@.êÓ&ã.6.9ã.C
00000070   60 4e f1 7a 73 2f 3d 22 - 9a 95 cc cd 42 f8 a6 b7  `Nñzs/="..ÌÍBø¦·
00000080   28 b9 07 a6 fb 57 bc 93 - b6 1c f6 67 aa 3b a8 c4  (¹.¦ûW¼.¶.ögª;¨Ä
00000090   21 29 5e 65 3d a6 26 23 - 10 db 1e 23 58 1b 7f 67  !)^e=¦&#.Û.#X..g
000000a0   3a d5 de f8 d4 5d 60 85 - fd 49 ec 52 c7 76 fa 1e  :ÕÞøÔ]`.ýIìRÇvú.
000000b0   4b d1 78 55 4b 01 7d cb - e2 ac 8a d4 a7 04 6c 42  KÑxUK.}Ëâ¬.Ô§.lB
000000c0   bf 2d e4 67 c4 78 59 ec - 28 cc dc 79 03 db dd d0  ¿-ägÄxYì(ÌÜy.ÛÝÐ
000000d0   2c f4 ad 7c 95 4c 3b 41 - 01 d2 d1 e2 9a 3b 4c 0d  ,ô|.L;A.ÒÑâ.;L.
000000e0   87 57 1c e8 f8 b2 9c c3 - bd 65 3a 09 b8 d6 b7 ed  .W.èø².Ã½e:	¸Ö·í
000000f0   86 af 75 b8 16 77 d3 eb - 12 99 88 14 51 d8 72 31  .¯u¸.wÓë....QØr1
00000100   7d 66 c8 e4 06 24 bd ec - 6f 03 9c e3 48 df 50 da  }fÈä.$½ìo..ãHßPÚ
00000110   b1 3e 2f 53 2c ea 27 7e - 2a 57 eb aa 6b 33 43 84  ±>/S,ê'~*Wëªk3C.
00000120   1d 8d 71 d7 37 87 5e 76 - dd 93 3a bd 69 76 6f 2b  ..q×7.^vÝ.:½ivo+
00000130   90 0a 07 ad 5e 4e db b8 - 38 f1 50 2e 08 b2 72 ce  ...^NÛ¸8ñP..²rÎ
00000140   14 f6 e7 85 f5 de a3 dd - 92 c4 56 95 da 78 74 fd  .öç.õÞ£Ý.ÄV.Úxtý
00000150   60 9e 07 e1 0f 3d 06 41 - 0e 90 62 85 98 3c d1 9b  `..á.=.A..b..<Ñ.
00000160   6b c2 61 72 16 27 ec 73 - b3 9c c3 09 da 64 f3 02  kÂar.'ìs³.Ã	Údó.
00000170   e2 6f ce 31 7e fa e9 50 - 62 94 b7 1e a7 53 0f e3  âoÎ1~úéPb.·.§S.ã
00000180   d4 76 97 20 fe 60 8a 4c - f8 b9 a4 f6 d6 e6 82 6d  Ôv. þ`.Lø¹¤öÖæ.m
00000190   dd 74 0f 87 1c ce 95 bb - 1e c4 60 12 e1 35 17 3f  Ýt...Î.».Ä`.á5.?
000001a0   f4 64 7f 7c bd 4c 04 fb - 9f 8c 06 67 18 8a 16 8c  ôd.|½L.û...g....
000001b0   4e 61 8f 79 34 16 cf f1 - 35 52 65 47 09 1c 93 49  Na.y4.Ïñ5ReG	..I
000001c0   1e 81 fc 21 35 37 5f 1b - 17 2f 9c 04 ed ca 2e de  ..ü!57_../..íÊ.Þ
000001d0   84 79 85 ed bc 79 f4 73 - 6b ba b3 35 90 46 02 86  .y.í¼yôskº³5.F..
000001e0   63 8e c1 3c 5e 7a 87 47 - 6a 3b 42 87 36 d9 06 a9  c.Á<^z.Gj;B.6Ù.©
000001f0   0d 68 21 98 39 2c f7 ee - ee 90 68 89 f6 8d 46 60  .h!.9,÷îî.h.ö.F`
00000200   36 1f f2 ba ce 5f 92 af - 73 db 6d 86 28 05 4a 4c  6.òºÎ_.¯sÛm.(.JL
00000210   2e e3 b6 02 0c b6 92 1f - 77 22 b0 9d 91 4a 3b 78  .ã¶..¶..w"°..J;x
00000220   64 7a 78 ae 59 7b 45 33 - a2 85 47 27 39 8e 44 03  dzx®Y{E3¢.G'9.D.
00000230   12 1f 1f e5 9e 6c 04 8c - c8 7c 5d d2 c3 c0 7c 49  ...å.l..È|]ÒÃÀ|I
00000240   56 6c f9 9e 78 e1 d3 ab - 0c a9 58 41 9a 8f 32 e3  Vlù.xáÓ«.©XA..2ã
00000250   99 c6 ed 90 14 e5 3e d1 - 42 44 55 ed 5f c2 68 81  .Æí..å>ÑBDUí_Âh.
00000260   20 18 51 f6 47 58 1e 0c - a8 cd 85 09 c6 8e 5f d0   .QöGX..¨Í.	Æ._Ð
00000270   f7 9e 7e d6 38 fc 0f 99 - 9a 81 1f d1 1e 07 37 23  ÷.~Ö8ü.....Ñ..7#
00000280   cf b0 14 ab 23 ee 14 8a - 01 7b dc 46 19 13 d8 26  Ï°.«#î...{ÜF..Ø&
00000290   77 d1 c4 d7 9a 24 8f a2 - 87 64 fa 26 d0 63 cb 92  wÑÄ×.$.¢.dú&ÐcË.
000002a0   a3 04 bc 1a 1e 54 85 92 - 4d 74 3e 36 7f 20 72 e5  £.¼..T..Mt>6. rå
000002b0   e4 1d 74 35 74 d1 e9 80 - 7c b6 99 32 11 8a 9d 4f  ä.t5tÑé.|¶.2...O
000002c0   73 da 78 f5 7b 58 4a 81 - b6 dc 32 6c 49 0b 3b cb  sÚxõ{XJ.¶Ü2lI.;Ë
000002d0   5d bc 30 0c e0 1a 89 ee - 12 8f 55 e4 96 a1 10 cc  ]¼0.à..î..Uä.¡.Ì
000002e0   cb 13 a4 c9 ff 3a e8 d7 - a6 9d 55 11 51 df bc 5e  Ë.¤Éÿ:è×¦.U.Qß¼^
000002f0   6d 99 7c 06 0f d2 62 e6 - b0 f1 ce 79 96 a4 69 e3  m.|..Òbæ°ñÎy.¤iã
00000300   35 12 f2 42 76 18 8f 4b - 18 77 63 ce 68 87 e2 06  5.òBv..K.wcÎh.â.
00000310   57 68 fb 49 dd 22 be b2 - 5d 0c 2f 38 bc b0 fa e6  WhûIÝ"¾²]./8¼°úæ
00000320   e4 1d 71 aa 05 f4 75 44 - 9a 53 2f 77 db 08 e6 f6  ä.qª.ôuD.S/wÛ.æö
00000330   ee eb b0 ed ce ce a5 7b - 54 7a 64 a7 81 7c 34 4f  îë°íÎÎ¥{Tzd§.|4O
00000340   fb 96 a3 88 3e 93 2e 41 - c2 a5 e7 26 8d 90 6a d9  û.£.>..AÂ¥ç&..jÙ
00000350   8c 53 da 8a ad 0d d2 59 - 34 6d 0a e8 5a 73 4d a2  .SÚ..ÒY4m.èZsM¢
00000360   53 0c 93 cf 31 80 25 5d - f7 ad b6 24 ad e3 bf e5  S..Ï1.%]÷¶$ã¿å
00000370   c3 e9 94 a5 02 fd c8 3d - a7 ac 5e 2e 32 64 84 1c  Ãé.¥.ýÈ=§¬^.2d..
00000380   23 d4 1a 46 91 4f f7 8e - ad ec 4f e8 81 6c be 37  #Ô.F.O÷.ìOè.l¾7
00000390   85 9f a3 4a 53 1b f4 8f - 3f 6d 5d 88 93 1d a4 b2  ..£JS.ô.?m]...¤²
000003a0   21 f3 94 da 52 d7 6c 09 - 49 dd 67 91 7c 06 ee 76  !ó.ÚR×l	IÝg.|.îv
000003b0   fc 17 dd 06 d5 d8 1f 67 - dc 82 4e ba 28 79 73 b7  ü.Ý.ÕØ.gÜ.Nº(ys·
000003c0   83 09 00 39 2f a1 9a 68 - d3 6b 90 a2 b6 ae 3d 37  .	.9/¡.hÓk.¢¶®=7
000003d0   06 0e fb 65 f7 63 52 fd - ab e7 f6 3f 84 e5 40 e3  ..ûe÷cRý«çö?.å@ã
000003e0   52 95 8a 3f 3e 35 cd 4d - 07 d5 df 79 5b 93 74 00  R..?>5ÍM.Õßy[.t.
000003f0   61 a0 de 42 2f 54 44 0b - f7 a6 8c 55 43 c3 50 3c  a ÞB/TD.÷¦.UCÃP<
00000400   4c de 20 00 20 fd 08 f6 - e1 53 e7 92 ec 42 b0 16  LÞ . ý.öáSç.ìB°.
00000410   ca fe f7 26 c4 2d 12 1a - a2 56 02 2b a6 e1 5a 72  Êþ÷&Ä-..¢V.+¦áZr
00000420   bb 4a 07 82 1a bc b6 6f - bd 0a cf b2 4c d8 a1 24  »J...¼¶o½.Ï²LØ¡$
00000430   20 6b 03 d8 66 ea b7 08 - 83 23 7e 48 ae e7 ac 64   k.Øfê·..#~H®ç¬d
00000440   79 3c bb f6 72 a6 7c bc - fb 2b c3 4e 25 a4 c1 51  y<»ör¦|¼û+ÃN%¤ÁQ
00000450   b2 56 32 3b cf 4a fb dd - f7 e9 83 16 3e b5 00 b8  ²V2;ÏJûÝ÷é..>µ.¸
00000460   7a 51 f3 55 b1 15 f1 8a - e8 38 18 4c 19 5c 80 52  zQóU±.ñ.è8.L.\.R
00000470   e8 e1 b5 66 6c bc f0 a3 - 08 9f 8d b9 b8 7d 2b 98  èáµfl¼ð£...¹¸}+.
00000480   09 20 48 da ac f3 8e 62 - 32 b9 f2 63 1f b2 f4 dc  	 HÚ¬ó.b2¹òc.²ôÜ
00000490   2e 1b 9f 4a 70 84 4a a6 - 85 17 db 3d c4 48 f7 e1  ...Jp.J¦..Û=ÄH÷á
000004a0   92 69 b7 eb aa d6 99 7d - e7 fc 76 85 f6 17 92 a8  .i·ëªÖ.}çüv.ö..¨
000004b0   7f 95 71 5e be 8b 32 ce - 83 c3 80 6b 9d 2a cb 15  ..q^¾.2Î.Ã.k.*Ë.
000004c0   fa ed                                              úí

Value 1
  Name:            pkc
  Type:            REG_BINARY
  Data:            
00000000   30 82 03 29 30 82 02 11 - a0 03 02 01 02 02 03 04  0..)0... .......
00000010   1e d2 30 0d 06 09 2a 86 - 48 86 f7 0d 01 01 0b 05  .Ò0..	*.H.÷.....
00000020   00 30 11 31 0f 30 0d 06 - 03 55 04 03 0c 06 45 4d  .0.1.0...U....EM
00000030   32 5f 43 41 30 1e 17 0d - 32 30 30 35 30 36 31 31  2_CA0...20050611
00000040   32 39 33 37 5a 17 0d 34 - 30 30 35 30 32 31 31 32  2937Z..400502112
00000050   39 33 37 5a 30 1c 31 1a - 30 18 06 03 55 04 03 0c  937Z0.1.0...U...
00000060   11 52 6f 75 74 65 72 24 - 65 73 6f 70 76 6d 31 30  .Router$esopvm10
00000070   34 31 30 82 01 22 30 0d - 06 09 2a 86 48 86 f7 0d  410.."0..	*.H.÷.
00000080   01 01 01 05 00 03 82 01 - 0f 00 30 82 01 0a 02 82  ..........0.....
00000090   01 01 00 be 68 d4 cb 19 - 77 17 f8 6a 85 b9 7e df  ...¾hÔË.w.øj.¹~ß
000000a0   4d 9d e3 2a 21 21 10 1a - 8f fb e2 59 c8 4c 89 a4  M.ã*!!...ûâYÈL.¤
000000b0   ba c3 2b 9d 5e f0 4b 95 - ce 7f 02 a7 e0 96 4e 89  ºÃ+.^ðK.Î..§à.N.
000000c0   56 97 71 8b e5 e9 78 60 - 3c 76 e3 9d 5f a5 86 18  V.q.åéx`<vã._¥..
000000d0   02 c2 52 b1 8e 3a a1 50 - cb 2b ca 52 e4 56 bd b6  .ÂR±.:¡PË+ÊRäV½¶
000000e0   69 e5 c0 ea e1 ac d9 91 - a1 10 82 66 4f 7d ed d5  iåÀêá¬Ù.¡..fO}íÕ
000000f0   bb 13 e8 96 63 11 75 03 - ef d3 07 1d 85 b4 8c 13  ».è.c.u.ïÓ...´..
00000100   2a 1f e2 90 d6 fe 1a 83 - eb 8c c0 f6 ca a7 2a d6  *.â.Öþ..ë.ÀöÊ§*Ö
00000110   82 c9 9f 7f 10 d8 fa a7 - d3 a5 db 49 5a 82 06 6f  .É...Øú§Ó¥ÛIZ..o
00000120   66 67 1f 05 9f 46 9f 38 - b2 94 f8 ad c1 3e cb 0c  fg...F.8².øÁ>Ë.
00000130   a3 bc 44 b4 72 43 37 46 - 62 31 30 27 cb f5 f2 7c  £¼D´rC7Fb10'Ëõò|
00000140   f1 a5 d4 1c 7e 6b a4 f7 - 57 58 e4 97 0f 82 1e 29  ñ¥Ô.~k¤÷WXä....)
00000150   31 d7 6c 0d c7 89 c6 50 - 82 c0 9c 3f 01 61 f3 56  1×l.Ç.ÆP.À.?.aóV
00000160   e5 71 2a 4b c0 a8 4a 50 - c8 2e 82 8a a8 ec 2c 0b  åq*KÀ¨JPÈ...¨ì,.
00000170   09 21 12 7f fe e7 b5 fb - 78 3f e1 1a 14 73 6f d0  	!..þçµûx?á..soÐ
00000180   fc 09 f8 8c 76 0e fa 2f - 78 80 83 e2 a5 fb 67 4a  ü	ø.v.ú/x..â¥ûgJ
00000190   05 02 4b 02 03 01 00 01 - a3 7f 30 7d 30 1d 06 03  ..K.....£.0}0...
000001a0   55 1d 0e 04 16 04 14 7a - 32 f2 72 59 ce 8a 78 ad  U......z2òrYÎ.x
000001b0   46 ba ed e5 9e ad d7 ac - 83 b2 91 30 39 06 03 55  Fºíå.×¬.².09..U
000001c0   1d 23 04 32 30 30 80 14 - bd bd 54 13 cd ab d7 a8  .#.200..½½T.Í«×¨
000001d0   d4 da a4 7c 47 24 62 94 - 37 a3 a9 70 a1 15 a4 13  ÔÚ¤|G$b.7£©p¡.¤.
000001e0   30 11 31 0f 30 0d 06 03 - 55 04 03 0c 06 45 4d 32  0.1.0...U....EM2
000001f0   5f 43 41 82 01 01 30 09 - 06 03 55 1d 13 04 02 30  _CA...0	..U....0
00000200   00 30 0e 06 03 55 1d 0f - 01 01 ff 04 04 03 02 05  .0...U....ÿ.....
00000210   a0 30 06 06 02 77 01 04 - 00 30 0d 06 09 2a 86 48   0...w...0..	*.H
00000220   86 f7 0d 01 01 0b 05 00 - 03 82 01 01 00 3f 1a 63  .÷...........?.c
00000230   be 28 3f 77 c3 b9 9d fd - 68 92 3e 43 58 12 5e 0b  ¾(?wÃ¹.ýh.>CX.^.
00000240   aa f4 32 62 90 92 94 e3 - d8 f4 84 c6 a1 88 a6 2e  ªô2b...ãØô.Æ¡.¦.
00000250   3e f9 79 48 9b dd fd f7 - 49 a0 63 69 69 15 65 d8  >ùyH.Ýý÷I cii.eØ
00000260   72 54 dd 34 4b 7b be f4 - df bc 06 43 80 9e 17 34  rTÝ4K{¾ôß¼.C...4
00000270   eb 89 15 ab 8a ae ab a9 - 00 37 59 b4 9a 27 0f 2b  ë..«.®«©.7Y´.'.+
00000280   15 d4 67 36 c6 95 7a a4 - 79 e3 60 fb c8 5b 9e b0  .Ôg6Æ.z¤yã`ûÈ[.°
00000290   0f dc 8b 92 90 36 e4 e5 - eb 08 79 7f 5f 7d e6 22  .Ü...6äåë.y._}æ"
000002a0   83 0c 29 82 d9 91 14 78 - fd 29 0f 09 63 98 3c e4  ..).Ù..xý).	c.<ä
000002b0   8b 52 02 10 6c 01 f0 bb - 9a 75 ca 70 06 db 45 e0  .R..l.ð».uÊp.ÛEà
000002c0   42 4b dc 65 0c 12 bd 01 - e6 01 07 d0 13 1b a9 04  BKÜe..½.æ..Ð..©.
000002d0   10 e3 6c 10 84 48 1d d1 - fb f6 42 e9 62 d8 c4 0c  .ãl..H.ÑûöBébØÄ.
000002e0   c2 86 8c ae 71 88 f2 66 - 9c 88 75 d1 b9 9e 64 65  Â..®q.òf..uÑ¹.de
000002f0   81 d1 1c 3f 16 c4 fd 80 - 54 2a 4a 4d 0c d5 95 be  .Ñ.?.Äý.T*JM.Õ.¾
00000300   7d d1 22 38 4c 55 fe 8a - ab 0b 23 53 26 91 ad b8  }Ñ"8LUþ.«.#S&.¸
00000310   67 44 fa d9 62 7a 11 fe - 3b c8 8a d4 6f 9f 13 aa  gDúÙbz.þ;È.Ôo..ª
00000320   c2 52 a8 78 47 3f 9f 7f - c3 b9 d1 52 51           ÂR¨xG?..Ã¹ÑRQ

This is the SEC router registry keys, I have added the IP after the iiop:// as part of my tests

Children

No Data