[cisco-voip] UDP port 3836

[Ryan Ratliff]

That would be a linestate update then.

-Ryan

On Nov 14, 2006, at 4:55 PM, Ed Leatherman wrote:

Excellent, thats just what I needed. Thanks!

Looks like its tcdsrv.exe, which sounds like its the TCD service -  
kinda what I thought. I'm puzzled why its still trying to talk to  
that IP addr though. When I sniff the traffic it looks like its just  
a directory number in the data portion of the packets (at least, its  
a number in the same format as our extensions)


On 11/14/06, J. Oquendo <sil at infiltrated.net> wrote: Ed Leatherman  
wrote:
 > Anyone know of a good reason why callmanager would want to talk to
 > another device on UDP/3836? I have 2 sub servers trying to talk to a
 > single IP address at that port.. no device is at that IP address
 > anymore although there could have been one in the past - PIX just
 > happened to be picking up the packets and logging them. trying to
 > figure out if its just a misconfiguration somewhere maybe with AC or
 > if its something I need to be more concerned with. Don't know of any
 > tools in windows that will let me see what process is originating it.

Hey Ed,

SANS shows an increase of activity to that port
(http://isc.sans.org/port_details.php?port=3836) have you tried sniffing
the line to see what callmanager is doing?

As for the tool you asked for:
http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx

Wow... Just realized MS took over Sysinternals.com

--
====================================================
J. Oquendo
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
sil . infiltrated @ net http://www.infiltrated.net

The happiness of society is the end of government.
John Adams






-- 
Ed Leatherman
Senior Voice Engineer
West Virginia University
Telecommunications and Network Operations
_______________________________________________
cisco-voip mailing list
cisco-voip at puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip