<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I checked my 6.1 servers and do not see similar traffic offhand. There
are numerous client applications that may 'subscribe' for updates from
CUCM. Examples include jtapi, Attendant Console, IPMA, and SIP. This
appears particularly likely given the source port range, from cucm,
uses numerous ports in the ephemeral range.<br>
<br>
What UC applications or plugins are installed on 172.16.54.33?
Alternatively, can you provide some of the payload?<br>
<br>
/Wes<br>
<br>
On Monday, March 09, 2009 7:12:27 PM, omar parihuana
<a class="moz-txt-link-rfc2396E" href="mailto:omar.parihuana@gmail.com"><omar.parihuana@gmail.com></a> wrote:<br>
<blockquote
cite="mid:834c50110903091612v49f8774kfeeebf77a3cee7a6@mail.gmail.com"
type="cite">Hi List,<br>
<br>
Today I've noticed that my RTP traffic rise above of the normal
parameters, after check the CUCM I've noticed that my CUCM tried to
connect to external host via UDP port 2048 here my outputs:<br>
<br>
admin:utils network capture dest 172.16.54.33 <br>
<br>
17:48:34.284360 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.284379 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.284398 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.294325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304347 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304366 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304385 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304403 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.314325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324342 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324361 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324379 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324397 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.334328 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344342 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344362 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344380 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344398 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.354328 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364347 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364366 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364386 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364404 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.374325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384345 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384364 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384383 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384400 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
<br>
What traffic is that? what application generate a lot of info with port
dest 2048. any ideas?<br>
<br>
Rgds.<br>
-- <br>
Omar E.P.T<br>
-----------------<br>
Certified Networking Professionals make better Connections!<br>
<pre wrap="">
<hr size="4" width="90%">
_______________________________________________
cisco-voip mailing list
<a class="moz-txt-link-abbreviated" href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a>
<a class="moz-txt-link-freetext" href="https://puck.nether.net/mailman/listinfo/cisco-voip">https://puck.nether.net/mailman/listinfo/cisco-voip</a>
</pre>
</blockquote>
<br>
</body>
</html>