UDP Port 4001

[rcfoltz]

Does anyone know what traffic destined to an IP phone on UDP port 4001 would be for? The traffic flow is coming in via a CUBE gateway, sourced from a random port, and destined to a Cisco 6900 series IP phone on port 4001, using UDP. I can't find any documentation showing this as a legitamate traffic flow. Anyone have any advice?

[Ryan Hilfers]

rcfoltz,

Were you ever able to explain this behavior?  I am seeing the same thing in my environment.

[Paul Freiberg]

Same behaviour, same Question. Any update?

[Manish Gogna]

Hi Paul,

It is most likely coming from a custom application, and infact may not be a legitimate traffic flow. This port is not specified for any Cisco applications interacting with IP phone so you may need to filter the traffic at the CUBE.

Manish

- Do rate helpful posts -

[Paul Freiberg]

Thx 4 your answer,

I will reject it.

[Mohammed al Baqari]

How are you seeing this taffic? Are you using packet capture or netflow, etc?

[Paul Freiberg]

Hi,

we removed our two isr from the voip server, which have another router as standard gateway subnet and migrated it to an transid net. I do not migrated the transcoder configs to the new IPs. Therfore I saw these pakets on an access-list on the next router which is the feault gateway for the two isr. After I configured the transcoder with the correct IPs I newer saw the pakets again.