| Protocol | ID | DPI version | Protocol group | Protocol type | Update | Description |
|---|
| db-lsp-disc | 17500 | 12.2 | Data bases | Built-in | As needed | DB-LSP-Disc discovers local secure database services and their listening service points. |
| ea | 17729 | 12.2 | Unknown | Built-in | As needed | ea operates on port 17729 and is used by EA (Enterprise Application) for enterprise-level app communication. |
| zep | 17754 | 12.2 | Unknown | Built-in | As needed | zep operates on port 17754 and is used for transmitting compressed sensor data in ZigBee environments, typically in wireless sensor networks. |
| zigbee-ip | 17755 | 12.2 | Unknown | Built-in | As needed | zigbee-ip operates on port 17755 and supports IPv6 communication over IEEE 802.15.4-based ZigBee networks. |
| zigbee-ips | 17756 | 12.2 | Unknown | Built-in | As needed | zigbee-ips operates on port 17756 and provides secure IPv6 transport for ZigBee networks using IPSec-like mechanisms. |
| sw-orion | 17777 | 12.2 | Unknown | Built-in | As needed | sw-orion operates on port 17777 and enables system monitoring, telemetry, or alerting functions in SolarWinds Orion platforms. |
| biimenu | 18000 | 12.2 | Unknown | Built-in | As needed | biimenu may be used for messaging or chat services (port 18000). |
| radpdf | 18104 | 12.2 | Unknown | Built-in | As needed | radpdf operates on port 18104 and facilitates RadPDF for PDF rendering or management over networks. |
| racf | 18136 | 12.2 | Unknown | Built-in | As needed | racf operates on port 18136 and is used by RACF (Resource Access Control Facility) for security and access control. |
| opsec-cvp | 18181 | 12.2 | Unknown | Built-in | As needed | opsec-cvp operates on port 18181 and enables content vectoring protocol services in firewall and proxy integrations. |
| opsec-ufp | 18182 | 12.2 | Unknown | Built-in | As needed | opsec-ufp operates on port 18182 and handles unified firewall policy services in Check Point OPSEC architecture. |
| opsec-sam | 18183 | 12.2 | Unknown | Built-in | As needed | opsec-sam operates on port 18183 and provides session authentication management in OPSEC-based infrastructures. |
| opsec-lea | 18184 | 12.2 | Unknown | Built-in | As needed | opsec-lea operates on port 18184 and supports Log Export API (LEA) in Check Point firewalls for security event logging. |
| opsec-omi | 18185 | 12.2 | Unknown | Built-in | As needed | opsec-omi operates on port 18185 and enables Open Management Interface services for Check Point OPSEC integration. |
| ohsc | 18186 | 12.2 | Unknown | Built-in | As needed | ohsc operates on port 18186 and supports secure communications in OHSC systems used in healthcare or compliance. |
| opsec-ela | 18187 | 12.2 | Unknown | Built-in | As needed | opsec-ela operates on port 18187 and manages encrypted log access in OPSEC event logging systems. |
| checkpoint-rtm | 18241 | 12.2 | Unknown | Built-in | As needed | Check Point Real-Time Monitoring protocol for firewall and security event tracking. |
| iclid | 18242 | 12.2 | Unknown | Built-in | As needed | iclid operates on port 18242 and provides device identification services in ICL enterprise systems. |
| clusterxl | 18243 | 12.2 | Unknown | Built-in | As needed | Check Point ClusterXL protocol for high availability and load-balanced firewall clusters. |
| gv-pf | 18262 | 12.2 | Unknown | Built-in | As needed | gv-pf operates on port 18262 and supports grid visualization or processing features in GV-PF compute frameworks. |