I got this from our BP when I asked about QOS and ports
"The traffic that I would expect to be seen in the .... Company configuration would be the actual bearer traffic between the different locations, if we were to look at a "sniff" we would see traffic between the different VOIP resources of the G700s(you can see these IPs by doing a "show interface" within each MGP), as well as, the IP addresses of the Medpros("list node-name) at the main location using UDP port ranges translated on the network region screens."
Look at the ip-network-region screens for UDP port ranges.
"I would also expect to see the signaling traffic(H.248) between the CLANs at the main and the MGPs at the remote locations, I would expect to see this traffic on either TCP port 2945 or 1039 depending on whether or not the link is encrypted."
I think the 2945 is un-encrypted.
"And finally we would expect to see the data that makes up the filesync(.xln pushed from the main to each LSP), on R12(2.x) this traffic occurs on TCP port 21873. The filesync traffic would only be seen if an administrator completed a "save trans lsp" within ACM or every morning when the server runs maintenance.
We are running R12 (2.1) so the way he worded the above statement may mean that the port changes in CM3.