Network and ports

Every port, protocol, and hostname SoundBase uses — cloud traffic, local listeners, device discovery and control, spectrum analyzers, and integrations.

Directions are from the SoundBase machine’s point of view: out = SoundBase connects to something; in = something connects to SoundBase (these are the ones desktop firewalls prompt about).

General requirements

IPv4 only. Device discovery and control run over IPv4; IPv6 is not used.
Pick a network interface. All device traffic binds to the network interface selected on the device setup page — devices won’t appear until one is chosen.
Same subnet as your devices. Discovery relies on multicast (224.0.0.251, 239.255.254.253) and broadcast, which don’t cross routers. Keep SoundBase and your receivers in one L2 network, allow multicast/broadcast on the switch, and make sure IGMP snooping isn’t filtering those groups.
macOS: grant SoundBase Desktop the Local Network permission when prompted — without it, all device discovery fails silently.
Windows: allow SoundBase Desktop through the firewall for private (and if applicable, domain) networks.

Cloud services (outbound, TCP 443 / HTTPS + WSS)

For strict egress policies, allow these hostnames:

Host	Purpose
`my.soundbase.app`	Web app, cloud API, desktop update feed
`sync.soundbase.app`, `prod-rest-sync.soundbase.services`	Project sync and the Live Report API
`prod.soundbase-transport.com`	Realtime presence/transport (WebSocket)
`tvscout.soundbase.services`	TV channel data
`soundbase-app-services.com`	Equipment profile and import conversions
`soundbase-assets.com`, `*.cloudfront.net`	Static assets, equipment icons, desktop downloads
`api.openweathermap.org`, `api.what3words.com`	Site weather widget, location search
`o4506739641155584.ingest.sentry.io`	Crash reporting
`billing.stripe.com`	Subscription billing portal (user-initiated)

The browser app additionally loads analytics from cdn.matomo.cloud / sennheiseruserinsights.matomo.cloud — only after consent, and never in SoundBase Desktop.

Servers SoundBase Desktop runs (inbound)

Port	Protocol	Default bind	Purpose
9999	TCP (HTTP + WebSocket)	all interfaces	Remote View server. Auto-starts with your project by default. Port configurable (1–65535), bindable to one interface
5480	TCP (HTTP + WebSocket)	localhost	Bitfocus Companion bridge — Companion connects to SoundBase. Change the bind host to reach it from another machine
9000	UDP	all interfaces	OSC listener for the REAPER integration (REAPER sends here). Configurable

SoundBase Desktop also runs internal services bound to localhost or ephemeral ports (its embedded database and app server); they need no firewall configuration but explain extra listeners you may notice in netstat.

Outbound to REAPER: OSC over UDP 8000 to the machine running REAPER (configurable; must match REAPER’s listen port).

Wireless device discovery (LAN)

Port	Protocol	Traffic	Used for
5353	UDP	multicast `224.0.0.251`, in + out	mDNS/Bonjour
8427	UDP	multicast `239.255.254.253`, in + out	device discovery
8133	UDP	multicast, in + out	device discovery and control
65535 / 65534	UDP	broadcast `255.255.255.255`	discovery
2201	UDP	inbound announcements	device control
4080	TCP	outbound subnet sweep	device discovery and control

Wireless device control (outbound to each device’s IP)

Port	Protocol	Devices
2202	TCP	device control
2202	UDP	device control
45	UDP	device control
443	TCP (HTTPS)	device control
5000	UDP	device control
6970	UDP	device control
2101	TCP	device control
2102–2105	TCP	device control
6500	TCP (TLS)	device control

Spectrum analyzers (outbound)

Port	Protocol	Device
7000	TCP	tinySA Ultra (Network)
1015	TCP (SCPI)	Owon HSA1016 (port configurable in the connect dialog)
8088	TCP (HTTP)	Spectrum Analyzer Bridge (configurable)
80	TCP (HTTP)	RF Venue Spectrum Recorder
2101	TCP	Wisycom MRK16 (spectrum via its control connection)

For step-by-step firewall instructions, see Configuring ports.