Port 1620: BMC Discovery — The Port That Maps the Network

Port 1620 lives in the registered ports range (1024-49151)—the middle territory between the famous well-known ports below 1024 and the wild ephemeral ports above 49152. These are ports claimed by organizations who asked IANA "can we have this number?" and got a yes.

What Runs Here

Port 1620 is used by BMC Discovery (formerly known as ADDM - Application Dependency Discovery and Mapping), a tool that automatically discovers and maps IT infrastructure.¹²

The software asks every device on your network: What are you? What's running on you? What are you connected to? It builds a map of your entire infrastructure—servers, applications, databases, dependencies—without requiring agents installed on every machine.

There's something recursive about it. Discovery software that discovers things needs to be discovered first. To map the network, it needs a location on the map. Port 1620 is that location.

How It Works

BMC Discovery uses multiple protocols and ports to scan networks, but port 1620 is specifically used for communication between Discovery components—the appliance talking to other parts of the BMC infrastructure, reconciliation engines pulling data, configuration management databases receiving updates.²³

The process:

1. The Discovery appliance scans your network using various protocols (SSH, WMI, SNMP, and dozens more)
2. It identifies devices, operating systems, installed software, running services
3. It maps relationships—this application talks to that database, this server depends on that load balancer
4. The data flows back through port 1620 to reconciliation engines that consolidate it all into a single unified view

The goal: know what you have, how it's connected, and what would break if something failed.

Why Discovery Tools Matter

You can't secure what you don't know exists. You can't maintain what you can't see. You can't plan capacity for infrastructure you haven't counted.

Most organizations don't actually know everything running on their networks. A server someone set up three years ago. A test database that became production. A backup system nobody remembered to document. Shadow IT deployed by a team that didn't want to wait for approval.

Discovery tools find these things. They're the cartographers of digital infrastructure. And like any explorer, they need a home base. For BMC Discovery, that's port 1620.

The Registered Ports Range

Port 1620 sits in the registered range (1024-49151), which means BMC Software (or its predecessor) requested this port from IANA and got it assigned. Unlike well-known ports (0-1023) which require root privileges to bind on Unix systems, registered ports can be used by regular user processes.

This is the range where enterprise software lives. Databases, monitoring tools, management systems—anything that needs a consistent port number but isn't famous enough to justify a well-known port.

Security Considerations

If BMC Discovery isn't running on your network, port 1620 shouldn't be open. An unexpected listener here could indicate:

• Unauthorized discovery/scanning tools
• A forgotten BMC installation
• Something masquerading as legitimate infrastructure software

The discovery process itself is sensitive. A tool that maps your entire infrastructure is exactly what an attacker would want access to. It's a complete blueprint of your network handed to anyone who can query it. These systems should be tightly controlled and monitored.

Checking What's Listening

To see if anything is listening on port 1620:

Linux/Mac:

sudo lsof -i :1620
# or
sudo netstat -tulpn | grep 1620

Windows:

netstat -ano | findstr :1620

If something is listening and you're not running BMC Discovery, investigate immediately.

Related Ports

BMC Discovery doesn't operate in isolation. The complete BMC infrastructure ecosystem uses various ports for different components:

• Port 80/443 - Web interface for the Discovery console
• Port 161/162 - SNMP for network device discovery
• Port 22 - SSH for Unix/Linux system discovery
• Port 135/445 - WMI for Windows system discovery

Port 1620 is specifically for component communication within the BMC infrastructure itself—the nervous system of the discovery system.

The Nature of Infrastructure Discovery

There's an interesting philosophical question here: when you run discovery software, are you discovering what exists, or are you creating a model that approximates what exists?

The network doesn't know it's a network. Devices don't know they're part of infrastructure. They just send packets and respond to requests. The discovery tool imposes structure—draws boundaries, creates categories, labels relationships.

Port 1620 carries that imposed structure. The map is not the territory, but sometimes the map is all you have.