Odd traffic generated from Exchange Server

From: Caruso, Anthony J. (acarusoat_private)
Date: Wed Oct 24 2001 - 09:53:09 PDT

  • Next message: Ryan Hill: "RE: Odd traffic generated from Exchange Server"

    Hi All:
    Outbound ACLs on my router has started picking up traffic originating from
    one of my Exchange boxes:
    Oct 23 10:12:18 router1 list 101 denied udp ->
    The source port is usually different and the destination port oscillates
    between 1046 and 1171.  The traffic occurs about every 15 min in quick
    bursts (incremental source ports), I am running a sniff now.
    Any ideas?
    Exchange 5.5 Sp3, NT 4.0SP6a no additional patches.  Internal RFC 1918
    addressed Exchange server.
    I am putting out an altogether different fire right now, but I will post
    traces as I get more info.
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com

    This archive was generated by hypermail 2b30 : Wed Oct 24 2001 - 10:02:20 PDT