UDP Port 4001
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-23-2011 08:13 AM - edited 03-16-2019 04:06 AM
Does anyone know what traffic destined to an IP phone on UDP port 4001 would be for? The traffic flow is coming in via a CUBE gateway, sourced from a random port, and destined to a Cisco 6900 series IP phone on port 4001, using UDP. I can't find any documentation showing this as a legitamate traffic flow. Anyone have any advice?
- Labels:
-
Other IP Telephony
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
06-24-2011 08:06 PM
rcfoltz,
Were you ever able to explain this behavior? I am seeing the same thing in my environment.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-17-2015 03:12 AM
Same behaviour, same Question. Any update?

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-17-2015 03:30 AM
Hi Paul,
It is most likely coming from a custom application, and infact may not be a legitimate traffic flow. This port is not specified for any Cisco applications interacting with IP phone so you may need to filter the traffic at the CUBE.
Manish
- Do rate helpful posts -
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-17-2015 03:57 AM
Thx 4 your answer,
I will reject it.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-17-2015 10:36 AM
How are you seeing this taffic? Are you using packet capture or netflow, etc?
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-20-2015 05:34 AM
Hi,
we removed our two isr from the voip server, which have another router as standard gateway subnet and migrated it to an transid net. I do not migrated the transcoder configs to the new IPs. Therfore I saw these pakets on an access-list on the next router which is the feault gateway for the two isr. After I configured the transcoder with the correct IPs I newer saw the pakets again.
