Sessions between IP Phone and CUCM

[Muhammad Saleem Anwar]

Dear All,

Can someone help me to provide information about the given below sessions between IP Phone and CUCM Publisher and Subscriber. Why source and destination both ports are higher and what kind of communication happens during the sessions. As i have reply to security team about this communication.

[Joshua Nordquist]

Your looking for the services that use the ephemeral ports.

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/10_0_1/CUCM_BK_T537717B_00_tcp-port-usage-guide-100.html

It's probably TFTP from the phones requesting config info from the CUCM servers. You can check for sure with a packet capture on the phones though.

https://supportforums.cisco.com/t5/collaboration-voice-and-video/collecting-a-packet-capture-from-a-cisco-ip-phone/ta-p/3119480

[Muhammad Saleem Anwar]

As per the document, ephemeral ports start from 32768 but as you can see in screen shot, sessions are using 16000 port too. 

Note	The ephemeral port range for the system is 32768 to 61000.