Thank for your prompt response, I've just stopped service per service I've found that after stop the service: Cisco IP Voice Media Streaming App, the strange traffic disappeared!<br><br>admin:utils network capture dest 172.16.54.33<br>
Executing command with options:<br> size=128 count=1000 interface=eth0<br> src= dest=172.16.54.33 port= <br> ip= <br><br><br>Now, which is the purpose of that service??? I suppose that cisco web page will be useful... thanks!!<br>
<br>Rgds.<br><br><div class="gmail_quote">On Mon, Mar 9, 2009 at 6:37 PM, Wes Sisk <span dir="ltr"><<a href="mailto:wsisk@cisco.com">wsisk@cisco.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div bgcolor="#ffffff" text="#000000">
I checked my 6.1 servers and do not see similar traffic offhand. There
are numerous client applications that may 'subscribe' for updates from
CUCM. Examples include jtapi, Attendant Console, IPMA, and SIP. This
appears particularly likely given the source port range, from cucm,
uses numerous ports in the ephemeral range.<br>
<br>
What UC applications or plugins are installed on 172.16.54.33?
Alternatively, can you provide some of the payload?<br>
<br>
/Wes<div><div></div><div class="h5"><br>
<br>
On Monday, March 09, 2009 7:12:27 PM, omar parihuana
<a href="mailto:omar.parihuana@gmail.com" target="_blank"><omar.parihuana@gmail.com></a> wrote:<br>
</div></div><blockquote type="cite"><div><div></div><div class="h5">Hi List,<br>
<br>
Today I've noticed that my RTP traffic rise above of the normal
parameters, after check the CUCM I've noticed that my CUCM tried to
connect to external host via UDP port 2048 here my outputs:<br>
<br>
admin:utils network capture dest 172.16.54.33 <br>
<br>
17:48:34.284360 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.284379 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.284398 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.294325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304347 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304366 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304385 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.304403 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.314325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324342 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324361 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324379 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.324397 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.334328 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344342 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344362 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344380 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.344398 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.354328 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364347 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364366 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364386 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.364404 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.374325 PECMA01.galileo.ebel.27284 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384345 PECMA01.galileo.ebel.27364 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384364 PECMA01.galileo.ebel.27332 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384383 PECMA01.galileo.ebel.27236 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
17:48:34.384400 PECMA01.galileo.ebel.27222 > 172.16.54.33.2048: udp
172 (DF) [tos 0xb8] <br>
<br>
What traffic is that? what application generate a lot of info with port
dest 2048. any ideas?<br>
<br>
Rgds.<br>
-- <br>
Omar E.P.T<br>
-----------------<br>
Certified Networking Professionals make better Connections!<br>
</div></div><pre><hr size="4" width="90%">
_______________________________________________
cisco-voip mailing list
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a>
</pre>
</blockquote>
<br>
</div>
</blockquote></div><br><br clear="all"><br>-- <br>Omar E.P.T<br>-----------------<br>Certified Networking Professionals make better Connections!<br>