I've posted on this topic in the past but I'll see if I can write a simple summary of how RSLinx Classic uses TCP Ports 2222 and 44818.
TCP Port 2222 was used by the old A-B "CSPv4" Ethernet protocol for the PLC-5E and early SLC-5/05 controllers.
TCP Port 44818 is used by the EtherNet/IP protocol used by all ControlLogix family controllers and all the MicroLogix controllers. Modern (10 years or less) PLC-5E and SLC-5/05 controllers support both protocols.
When the RSLinx Classic "Ethernet Devices" driver starts to browse its list of IP hosts, it first has to determine if the device uses CSPv4 or EtherNet/IP.
If you have added the ":EIP" suffix to the host IP address in the IP host table, RSLinx knows that the device uses EtherNet/IP and goes directly to creating a TCP connection on TCP Port 44818.
If there's no ":EIP" suffix, RSLinx has to probe the device to figure out what it is.
So it starts by requesting a connection on TCP Port 2222. If it gets a connection, it proceeds to interrogate the device ID and shows it in the RSWho browse.
If it gets a "connection refused" answer on TCP Port 2222, it tries two more times then switches to attempting a connection on TCP Port 44818.
Here's the trickiest part: there's a difference between a "connection refused" answer from a device and just a timeout where the device doesn't answer.
RSLinx Classic needs to see three "Connection Refused" answers from TCP Connection requests on TCP Port 2222 before it will automatically switch over from CSPv4 to EtherNet/IP.
[
Insert Saint Peter joke here.]
Some routers and firewalls will allow through the first TCP Connection request and will monitor the fact that the device sent a "Connection Refused" answer.
When they get the second request... they consider it to be a TCP Probe attack and block the response. RSLinx Classic gets one response and two timeouts, so it declares a timeout instead of attempting to connect to TCP Port 44818.