Port 1161 carries the heartbeat of enterprise monitoring. On this port, CA eHealth and CA Spectrum managers poll SystemEDGE agents with a simple question: are you still there?
What Runs on Port 1161
Port 1161 is officially registered with IANA for the health-polling service.1 It's used by CA (now Broadcom) SystemEDGE agents—monitoring software that runs on servers to watch their health and report problems before they become critical.
The protocol is straightforward: UDP packets flow from eHealth managers to SystemEDGE agents on port 1161, asking if the system is responsive. Every reply means another server still running, another application still healthy, another piece of infrastructure still doing its job.
How Health Polling Works
SystemEDGE agents run autonomously on monitored systems—servers, applications, databases—collecting metrics and watching for problems. But the managers need to know the agents themselves are alive. That's where port 1161 comes in.
The polling cycle:
- CA eHealth or CA Spectrum manager sends UDP health-polling packet to port 1161
- SystemEDGE agent receives the packet and responds
- Manager marks the system as healthy
- Process repeats at configured intervals
If the agent doesn't respond, the manager knows something is wrong—either the agent crashed, the system is down, or the network path is broken. This simple mechanism catches failures before users notice them.
The History
CA eHealth emerged in the mid-1990s as enterprise networks grew complex enough that manual monitoring became impossible. You needed automated systems watching your systems. SystemEDGE agents became the eyes and ears distributed across infrastructure, and port 1161 became the channel for checking those eyes and ears were still open.2
The service was eventually discontinued in 2018,3 but the port assignment remains registered. Organizations that built monitoring infrastructure around this protocol may still be using it—legacy deployments where port 1161 still carries those quiet heartbeat checks.
Why UDP
Health polling uses UDP, not TCP. This is intentional. The managers don't need guaranteed delivery—they need fast answers. If a health check packet gets lost, the next one arrives in seconds anyway. UDP's low overhead means you can poll thousands of agents without drowning in connection management.
The trade-off: you can't tell the difference between a lost packet and a dead agent. But that's fine. If multiple consecutive polls fail, something is definitely wrong. One missed packet is noise. Five missed packets is a problem.
Security Considerations
Port 1161 creates a network entry point into every monitored system. If an attacker can reach this port, they can potentially probe your infrastructure—discovering which systems are running SystemEDGE and mapping your monitoring topology.
Protection strategies:
- Restrict port 1161 to monitoring network segments
- Use firewall rules to allow only known manager IP addresses
- Consider VPN tunnels for remote monitoring
- Monitor for unexpected traffic patterns on this port
The polling traffic itself is lightweight, but it reveals presence. Every response tells an observer "there's a SystemEDGE agent here." In security-sensitive environments, even that metadata matters.
Checking What's Using Port 1161
On Linux/macOS:
On Windows:
If you see something listening on port 1161 and you're not running CA/Broadcom monitoring software, investigate. It could be a misconfigured application or something that shouldn't be there.
Related Ports
- Port 5723 - SystemEDGE agent's primary communication port
- Port 161 - SNMP (Simple Network Management Protocol), another monitoring standard
- Port 162 - SNMP Trap, for asynchronous alerts
SystemEDGE uses multiple ports for different functions. Port 1161 is specifically for health polling—the lightest touch, the quickest check, the simple heartbeat.
The Legacy
CA eHealth is gone, but the pattern remains. Modern monitoring systems still need to check if their agents are alive. Prometheus, Nagios, Zabbix—they all implement some version of health polling, even if they don't use port 1161.
The question hasn't changed: are you still there?
The port that carries the answer: 1161.
Frequently Asked Questions About Port 1161
ئایا ئەم پەڕەیە بەسوود بوو؟