ESXi vSphere Management Traffic on Port 902

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects network traffic destined for TCP port 902 on the home network, which is commonly used for ESXi vSphere management. The rule specifically looks for established TCP connections to this port and triggers an alert if five such connections are observed from the same source within a 30-second window. This could indicate management activity or potential reconnaissance/attack against ESXi hosts.