Cisco Cisco Firepower Management Center 4000

This event is generated when the system detects a new TCP server port (for example, a port used by 
SMTP or web services) active on a host. Note that this event is not used to identify the application 
protocol or the server associated with it; that information is transmitted in the TCP Server 
Information Update event.

If you select the 

 option and select 

 in a network discovery rule for NetFlow data, 

this event is also generated when a device processes NetFlow data involving a server on your 
monitored networks that does not already exist in the network map.

This event is generated when the system detects that a host is communicating with a new transport 
protocol, such as TCP or UDP.

This event is generated when the system detects a new UDP server port running on a host. 

If you select the 

option and select 

 in a network discovery rule for NetFlow data, 

this event is also generated when a device processes NetFlow data involving a server on your 
monitored networks that does not already exist in the network map.

This event is generated when the system detects that a TCP port has closed on a host.

This event is generated when the system has not detected activity from a TCP port within the interval 
defined in the system’s network discovery policy. See 

 for 

information about configuring the server timeout value.

This event is generated when the system detects a change in a discovered TCP server running on a 
host.

This event may be generated if a TCP server is upgraded.

This event is generated when the system detects that a UDP port has closed on a host.

This event is generated when the system has not detected activity from a UDP port within the 
interval defined in the network discovery policy. See 

 for 

information about configuring the server timeout value.

This event is generated when the system detects a change in a discovered UDP server running on a 
host.

This event may be generated if a UDP server is upgraded.

This event is generated when the system detects a change in the VLAN tag attributed to a host. For 
more information about VLAN tags, see 

.