<div>Just for Info</div>
<div>Here is the Cisco Doc on TCP/UDP ports that Call Manager Uses</div>
<div><a href="http://www.cisco.com/application/pdf/en/us/guest/products/ps5820/c1693/ccmigration_09186a00807217e1.pdf">http://www.cisco.com/application/pdf/en/us/guest/products/ps5820/c1693/ccmigration_09186a00807217e1.pdf
</a></div>
<div> </div>
<div>Steve<br><br> </div>
<div><span class="gmail_quote">On 11/14/06, <b class="gmail_sendername">Ryan Ratliff</b> <<a href="mailto:rratliff@cisco.com">rratliff@cisco.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">That would be a linestate update then.<br><br>-Ryan<br><br>On Nov 14, 2006, at 4:55 PM, Ed Leatherman wrote:
<br><br>Excellent, thats just what I needed. Thanks!<br><br>Looks like its tcdsrv.exe, which sounds like its the TCD service -<br>kinda what I thought. I'm puzzled why its still trying to talk to<br>that IP addr though. When I sniff the traffic it looks like its just
<br>a directory number in the data portion of the packets (at least, its<br>a number in the same format as our extensions)<br><br><br>On 11/14/06, J. Oquendo <<a href="mailto:sil@infiltrated.net">sil@infiltrated.net</a>
> wrote: Ed Leatherman<br>wrote:<br>> Anyone know of a good reason why callmanager would want to talk to<br>> another device on UDP/3836? I have 2 sub servers trying to talk to a<br>> single IP address at that port.. no device is at that IP address
<br>> anymore although there could have been one in the past - PIX just<br>> happened to be picking up the packets and logging them. trying to<br>> figure out if its just a misconfiguration somewhere maybe with AC or
<br>> if its something I need to be more concerned with. Don't know of any<br>> tools in windows that will let me see what process is originating it.<br><br>Hey Ed,<br><br>SANS shows an increase of activity to that port
<br>(<a href="http://isc.sans.org/port_details.php?port=3836">http://isc.sans.org/port_details.php?port=3836</a>) have you tried sniffing<br>the line to see what callmanager is doing?<br><br>As for the tool you asked for:
<br><a href="http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx">http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx</a><br><br>Wow... Just realized MS took over <a href="http://Sysinternals.com">
Sysinternals.com</a><br><br>--<br>====================================================<br>J. Oquendo<br><a href="http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743">http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
</a><br>sil . infiltrated @ net <a href="http://www.infiltrated.net">http://www.infiltrated.net</a><br><br>The happiness of society is the end of government.<br>John Adams<br><br><br><br><br><br><br>--<br>Ed Leatherman<br>
Senior Voice Engineer<br>West Virginia University<br>Telecommunications and Network Operations<br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net
</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br>_______________________________________________<br>cisco-voip mailing list<br><a href="mailto:cisco-voip@puck.nether.net">
cisco-voip@puck.nether.net</a><br><a href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a><br></blockquote></div><br>