I do not know what to expect here or what exactly to inform the customer. So I am simply relaying the customers' queries:
From the customers' IT manager:
"Guess main question is should the DW Server be actively scanning these ports? Wasn't sure if that was the way it operates or if there is something it periodically tries to discover new devices?"
"Particularly, 3389 (MSRDP), 8080 (proxy), etc. If it was scanning for a limited number of ports related to DW, that would be justified, but I see:
⋄ Total ports scanned: 260
⋄ Port range: 9 – 61001
That is WAY outside the justification for looking for other DW devices/applications.
Kindly provide some documentation on why this is required, and specifically, which ports are required to be discovered for proper operation. Otherwise, this will be locked down to prevent further network scanning."
Any further documentation, thoughts or recommendations to what to do about this if abnormal?