cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Webcast- Catalyst 9000
82
Views
0
Helpful
2
Replies

Sessions between IP Phone and CUCM

Dear All,

 

Can someone help me to provide information about the given below sessions between IP Phone and CUCM Publisher and Subscriber. Why source and destination both ports are higher and what kind of communication happens during the sessions. As i have reply to security team about this communication.

 

Sessions.JPG

2 REPLIES 2
Highlighted

Re: Sessions between IP Phone and CUCM

Your looking for the services that use the ephemeral ports.

 

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/10_0_1/CUCM_BK_T537717B_00_tcp-port-usage-guide-100.html

 

It's probably TFTP from the phones requesting config info from the CUCM servers. You can check for sure with a packet capture on the phones though.

 

https://supportforums.cisco.com/t5/collaboration-voice-and-video/collecting-a-packet-capture-from-a-cisco-ip-phone/ta-p/3119480

Re: Sessions between IP Phone and CUCM

As per the document, ephemeral ports start from 32768 but as you can see in screen shot, sessions are using 16000 port too. 

 

 

Note

The ephemeral port range for the system is 32768 to 61000.

CreatePlease to create content