A port list from the network team describes what a network is configured to allow. It does not describe which SAP services are answering, under which instance number, or what each of them returns to a caller who has presented no credentials, and those are the three things an SAP inventory has to state.
The two documents get confused because they share a vocabulary. Both talk about hosts and ports. One is a statement of intent written by people, the other a statement of fact produced by asking the machines, and they part company more often than either team expects.
Because a rule and a listener are independent facts, and they disagree in at least three ordinary ways.
None of that is an argument that network teams are careless. It is an argument about what a rule set can express: it expresses permission, and permission is not presence.
Because an SAP host does not have a port. It has a port per kind of process per instance number, and most SAP defaults are patterns rather than numbers, with the two-digit instance number substituted into them. The familiar example, an ABAP dispatcher on instance 01 answering on 3201, generalises badly: on several SAP services the instance digits sit in the middle of the number rather than at the end.
That is why a hand-maintained spreadsheet drifts. Get the substitution wrong on one service kind and you knock on a port nobody uses, find nothing, and write down that nothing is there. Some SAP ports carry no instance number at all, being infrastructure services that are identical on every system, and those two sets never mix, so the manual version means keeping two lists per host. SAP default ports and instance numbers sets out the rule and the exceptions to it.
Because the reply names the service and the port number does not. Several SAP service kinds share a default port pattern and are distinguishable only by what they send back, and the same daemon in two configurations is two different answers rather than one. A tool that reports an open port and a guess at the product behind it cannot say which of two services replied, and it cannot say whether the one that did reply is running in the configuration you assume.
The RedRays Security Platform treats identification as a reply-matching exercise for that reason: the port narrows the question, the answer settles it. What that produces is described in hosts, instances and SAP services.
A folder of output and a terminal scrollback. Neither records which addresses were tried and did not answer, so the exercise cannot distinguish a host that was checked and was silent from a host nobody got to. That distinction is the whole difference between an inventory and an impression.
It also leaves behind a date. An inventory built by hand is true on the day it is taken, and an instance added, a service enabled in the SAP Internet Communication Framework or a host stood up in a recovery site announces itself to nobody holding last quarter's spreadsheet.
This page is an argument about what a rule set can express, not a measurement: no firewall configuration has been reconciled against a scan here, and what would settle it for a specific landscape is running both against one segment and comparing them line by line.
It also does not claim that a scan is the more complete document. A scan sees what was reachable from where the scanner sat; the rule list covers paths the scanner was never on. The useful exercise is the disagreement between them.
A configuration management database records what was registered. A scan records what answered. They are worth comparing, and on most landscapes the interesting rows are the ones present in exactly one of the two.
No. It gives them something to check the list against, from one vantage point. Where the two disagree, one of them is out of date and the disagreement tells you which question to ask next.
Because the port arithmetic, the shared port patterns and the service fingerprints are specific to SAP. A generic scanner will report open ports correctly and name the services behind them wrongly, which is the kind of error that survives review because it looks like data.