[cisco-voip] UDP port 3836

[Ed Leatherman]

Excellent, thats just what I needed. Thanks!

Looks like its tcdsrv.exe, which sounds like its the TCD service - kinda
what I thought. I'm puzzled why its still trying to talk to that IP addr
though. When I sniff the traffic it looks like its just a directory number
in the data portion of the packets (at least, its a number in the same
format as our extensions)


On 11/14/06, J. Oquendo <sil at infiltrated.net> wrote:
>
> Ed Leatherman wrote:
> > Anyone know of a good reason why callmanager would want to talk to
> > another device on UDP/3836? I have 2 sub servers trying to talk to a
> > single IP address at that port.. no device is at that IP address
> > anymore although there could have been one in the past - PIX just
> > happened to be picking up the packets and logging them. trying to
> > figure out if its just a misconfiguration somewhere maybe with AC or
> > if its something I need to be more concerned with. Don't know of any
> > tools in windows that will let me see what process is originating it.
>
> Hey Ed,
>
> SANS shows an increase of activity to that port
> (http://isc.sans.org/port_details.php?port=3836) have you tried sniffing
> the line to see what callmanager is doing?
>
> As for the tool you asked for:
> http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx
>
> Wow... Just realized MS took over Sysinternals.com
>
> --
> ====================================================
> J. Oquendo
> http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
> sil . infiltrated @ net http://www.infiltrated.net
>
> The happiness of society is the end of government.
> John Adams
>
>
>
>


-- 
Ed Leatherman
Senior Voice Engineer
West Virginia University
Telecommunications and Network Operations
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://puck.nether.net/pipermail/cisco-voip/attachments/20061114/b13723e2/attachment.html