[c-nsp] Question on mystery VOIP traffic

[Steven Pfister]

I'm trying to track down the source of some strange traffic patterns in our network. All of our remote sites have VOIP from a remote PBX to a central PBX at our main facility. All of this was set up before I got here, and I have very little contact with it.

In checking out the strange traffic, I notice that several of these sites show a rather large amount of outgoing (from the site) UDP traffic to the central site with port numbers usually in the 15k to 20k range, all involving addresses and interfaces associated with voice. The amount of data transferred seems to be fairly large (one of the larger sites is sending 5.5 to 6gb per day), and is usually fairly steady throughout the day, 24x7. One exception to that that I've seen, is at the beginning of last month, the 5.5gb seemed to be once a day rather than spread out, but that was only for the first week. 

The head of telecom here isn't aware of anything that might cause that. Is this normal for VOIP?

Thanks!

Steve Pfister
Technical Coordinator, 
The Office of Information Technology
Dayton Public Schools
115 S. Ludlow St. 
Dayton, OH 45402
 
Office (937) 542-3149
Cell (937) 673-6779
Direct Connect: 137*131747*8
Email spfister at dps.k12.oh.us