On May 7, 2018, at 2:58 PM, Jay Farrell via NANOG <nanog@nanog.org<mailto:nanog@nanog.org>> wrote: I saw that list, but understood the numbers there to be IDS signature numbers, rather than port numbers. Am I misreading something? No, you are correct. As Niels Bakker pointed out that is a list of IDS signatures, not a list of ports that Cisco devices listen on. I just skimmed the pages, I should have read them more thoroughly before sending to the list. On Mon, May 7, 2018 at 12:24 PM, Curtis, Bruce <bruce.curtis@ndsu.edu<mailto:bruce.curtis@ndsu.edu>> wrote: Some Cisco devices use 6154 for ypxfrd. 6154 ypxfrd Portmap Request (Info, Atomic*) Triggers when a request is made to the portmapper for the YP transfer daemon (ypxfrd) port. https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/ configuration/guide/fsecur_c/scfids.html https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/ configuration/guide/asa_84_cli_config/protect_tools.html --- Bruce Curtis bruce.curtis@ndsu.edu<mailto:bruce.curtis@ndsu.edu> Certified NetAnalyst II 701-231-8527 North Dakota State University