Event 4771 - Client Port

Hi,

I searched the web and I am unable to an explanation for the parameter "Client Port" in  event ID 4771.

This is obviously the port used by <process_at_the_other_end> to cause the logon failure (eg. 0x18).

Does that <process_at_the_other_end> always end up being a windows authentication related process or can it be a non-OS related process (e.g. a custom application, malware,etc) ?

Thanks.