Symposium Server Port Scans

[BurntCookie]

We are in the middle of rolling out a Nortel IP phone system that includes a Symposium server. Whenever the server is turned on our IDS system and the personal firewalls on our laptops have been reporting port scans coming from that server on upd ports 6050, 6130, and 6120.
Has anyone seen this before ?

Thanks,

Paul

 

[NortelGuy1979]

That's what the client talks on, if I'm not mistaken.. Server could be looking for clients. -Matt

Matt H.
TMC - KCMO, USA

 

[BurntCookie]

Thanks, but I hope that's not it. I would hope the clients would be searching for the server. Not the other wat around.

 

[NortelGuy1979]

See this post. Might help. -Matt

http://www.tek-tips.com/viewthread.cfm?qid=842977

Matt H.
TMC - KCMO, USA

 

[BurntCookie]

Thanks Matt.

 

[NortelGuy1979]

No problem. This one too; it's a bit older and I just scanned it quickly, but it may help also. -Matt

http://www.tek-tips.com/viewthread.cfm?qid=651100

Matt H.
TMC - KCMO, USA

 

[BurntCookie]

It seems that all of these posts are talking about getting to the server. What I'm seeing are port scans coming from the server.

 

[PascalHL]

Hello,

Udp 6050, 6120 and 6130 are part of the Udp ports used for Real Time Multicast stats (mandatory with Swc).
It must be activated on your server, if it's a 4.2.
If you don't use Swc on your site, they should not be a problem, if only working with the client-server CCS.

Hope it will help

PG

 

[BurntCookie]

PascalHL,
Thanks for the reply.

So it's supposed to do port scans of all the p.c.'s on the network ?

What is Swc ?

Paul

 

[NortelGuy1979]

SWC = Symposium Web Client. SWC uses multi-cast, unless you have v4.5 and then you can use unicast. -Matt

Matt H.
TMC - KCMO, USA

 

[BurntCookie]

Okay, I hear what you guys are saying about the multicast / unicast. But, wouldn't that traffic come from the client not the server ? I can't imagine the software on the server is supposed to constantly do port scans of every pc on the network. What would the reason be for this ? It's the client that needs to contact the server not the other way around.

???

 

[NortelGuy1979]

I'm not sure it's doing 'scans' but the SCCS is looking for the SWC server on those ports. Your scanner may be incorrectly detecting it as an attempt to get on those ports, etc. -Matt

Matt H.
TMC - KCMO, USA

 

[Sympology]

If I rememeber correctly, when a multicast is chucked out, by any device, it is effectivly shouting "Who Wants This" and is directed to every pc on the subnet (and further if the routers allow it). In this case it will be chucked out by the server on those ports. Any machine listening that want them, goes yup, I'll have some of that, and communication is set up.Anyone not intrested just dumps it and ignores it. Having the server do the Hello broadcast is better than say 100 pc's doing the same thing.

Of course may be totally wrong....

Only the truly stupid believe they know everything.
Stu.. 2004

 

[BurntCookie]

I believe you're right about multicast just screaming out to everyone. This must be why Nortel has added unicast to 4.5. I talked to a Nortel engineer yesterday and he cleared up a lot about how they are doing things. He also said that the Symposium server only needs to sned these broadcasts out to the Nortel web server. And, by changing the TTL value in the multicast configuration on the Symposium server to 1 will limit the number of hops the broadcast takes to 1. As long as the web server and the Symposium server are on the same switch and the same vlan this will eliminate broadcasts out to the whole network.
He also said that if your using Windows Server 2003 and Symposium 5 Feature Pack 1 you can save yourself a server if you under 250 agents by putting the web server app. on the Symposium server.

 

[brewerdude]

Win2K3? I didn't think it was approved for that yet...

 

[sandyml]

Just recently released. However, do note that you have to have Feature Pack 1 version of Symposium 5.0. If you have 5.0 software but it is not Feature Pack 1, then you cannot use 2003. There is a charge to get the newer software version.

 

[brewerdude]

How do you tell if you have Feature Pack 1?

 

[sandyml]

Your application CD should be labeled as Symposium Call Center Server 5.0 Feature Pack 1.

 

[BurntCookie]

sandyml,
Are you saying that Symposium 5.0 can't go on Win2003 unless you have Feature Pack 1 ?

 

[sandyml]

That's correct.