There are default ports that are used, however from what I have read they can be customized on the CMS side.
Remember that CMS is the client and your RTA box/app is the server. So it's the CMS client that is selecting the ports to talk on, not the RTA.
If you have a spare linux box on the same subnet, you can simply fire up tcpdump -s0 -X not port ssh and dst [your rta box ip]
This will show you everthing that is talking to that box and their associated ports.
Your could also do: tcpdump -s0 -X not port ssh and dst [your rta box] and src [your cms ip]
Good luck.
==Zow