Excellent, thats just what I needed. Thanks! <br><br>Looks like its tcdsrv.exe, which sounds like its the TCD service - kinda what I thought. I'm puzzled why its still trying to talk to that IP addr though. When I sniff the traffic it looks like its just a directory number in the data portion of the packets (at least, its a number in the same format as our extensions)
<br><br><br><div><span class="gmail_quote">On 11/14/06, <b class="gmail_sendername">J. Oquendo</b> <<a href="mailto:sil@infiltrated.net">sil@infiltrated.net</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Ed Leatherman wrote:<br>> Anyone know of a good reason why callmanager would want to talk to<br>> another device on UDP/3836? I have 2 sub servers trying to talk to a<br>> single IP address at that port.. no device is at that IP address
<br>> anymore although there could have been one in the past - PIX just<br>> happened to be picking up the packets and logging them. trying to<br>> figure out if its just a misconfiguration somewhere maybe with AC or
<br>> if its something I need to be more concerned with. Don't know of any<br>> tools in windows that will let me see what process is originating it.<br><br>Hey Ed,<br><br>SANS shows an increase of activity to that port
<br>(<a href="http://isc.sans.org/port_details.php?port=3836">http://isc.sans.org/port_details.php?port=3836</a>) have you tried sniffing<br>the line to see what callmanager is doing?<br><br>As for the tool you asked for:
<br><a href="http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx">http://www.microsoft.com/technet/sysinternals/Networking/TcpView.mspx</a><br><br>Wow... Just realized MS took over <a href="http://Sysinternals.com">
Sysinternals.com</a><br><br>--<br>====================================================<br>J. Oquendo<br><a href="http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743">http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743
</a><br>sil . infiltrated @ net <a href="http://www.infiltrated.net">http://www.infiltrated.net</a><br><br>The happiness of society is the end of government.<br>John Adams<br><br><br><br></blockquote></div><br><br clear="all">
<br>-- <br>Ed Leatherman<br>Senior Voice Engineer<br>West Virginia University<br>Telecommunications and Network Operations