[c-nsp] Question on mystery VOIP traffic

[Church, Charles]

Not really sure what you mean by 'once per day', might make more sense
if you had a graph of it, NetFlow would be real useful.  That said, if
you think the traffic is all VoIP, it could be something as simple as a
scheduled conference call that occurs at the same time creating so much
traffic.  If you've got access to the call detail reports from the PBX,
you could probably find that there. 

Chuck 

-----Original Message-----
From: cisco-nsp-bounces at puck.nether.net
[mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of Steven Pfister
Sent: Thursday, July 10, 2008 9:21 AM
To: cisco-nsp at puck.nether.net
Subject: [c-nsp] Question on mystery VOIP traffic


I'm trying to track down the source of some strange traffic patterns in
our network. All of our remote sites have VOIP from a remote PBX to a
central PBX at our main facility. All of this was set up before I got
here, and I have very little contact with it.

In checking out the strange traffic, I notice that several of these
sites show a rather large amount of outgoing (from the site) UDP traffic
to the central site with port numbers usually in the 15k to 20k range,
all involving addresses and interfaces associated with voice. The amount
of data transferred seems to be fairly large (one of the larger sites is
sending 5.5 to 6gb per day), and is usually fairly steady throughout the
day, 24x7. One exception to that that I've seen, is at the beginning of
last month, the 5.5gb seemed to be once a day rather than spread out,
but that was only for the first week. 

The head of telecom here isn't aware of anything that might cause that.
Is this normal for VOIP?

Thanks!

Steve Pfister
Technical Coordinator, 
The Office of Information Technology
Dayton Public Schools
115 S. Ludlow St. 
Dayton, OH 45402
 
Office (937) 542-3149
Cell (937) 673-6779
Direct Connect: 137*131747*8
Email spfister at dps.k12.oh.us


_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/