sap-saprouterlisted

# SAProuter SAProuter is a small proxy that permits/denies network routes based on the **route-permission table (`saprouttab`)** — most commonly the controlled path to **SAP support** and between security zones. Default NI port **3299**. > **Guardrail:** SAProuter is a **security control** and often the **only path to SAP support**. A stop > can cut support connectivity and any tunnelled traffic. Editing `saprouttab` changes who can reach what — > treat it like a firewall rule: preview, confirm, keep `D` (deny) defaults tight. Never open `P * * *`. --- ## 1. Start / stop / status ```bash saprouter -r # START: run and load saprouttab (the permission table) [V, R1] saprouter -s # STOP (soft shutdown) [V, R1] saprouter -s -S <service> # STOP when running on a non-default port (not 3299) [V, R1] ``` Common start options: ```bash saprouter -r -R <routtab> -G <logfile> -T <tracefile> -W <timeout-ms> & ``` - `-R <file>` alternate route table (default `saprouttab` in the working dir) - `-G <logfile>` connection log · `-T <tracefile>` trace (see [logs](../sap-log-reference/SKILL.md)) - Windows: often run as a **service** (installed with `ntscmgr`); otherwise the same flags. **Status / info:** ```bash saprouter -l # list current routes/connections (info dump) saprouter -d # detailed dump ``` --- ## 2. Route-permission table (`saprouttab`)