Network Traffic

[AlfredSpecial]

I have an IP Office 412 running 2.1(27) with all users using Phone Manager Pro.

The network administrator has complained of extreme traffic on ports 137/138 and is blaming Phone Manager. This traffic is showing on their firewall as red(deny) traffic.

I have already proved the voicemail/delta server and smdr not to be the problem by turning off the PC

I was thinking of removing the system from the LAN but Phone manager will still be broadcasting so this will not isolate the problem.

At this time i cannot stop all users from using Phone Manager due to office politics.

By reading the DOCs Phone Manager does not use these ports anyway.

Is the next step to use monitor and if so what sort of trace should i do and does anyone know what application would use ports 137/138.

DNS is not in operation on the IPO

 

[sizbut]

137/138 are typically used for NetBIOS and to the best of my knowledge thats not Phone Manager unless one of the new 3.0 features is using it.

The big clue would be the source and destination address of the packets, if your guys can see port addresses then they can see IP addresses.

 

[TLDuk]

I think you need to look at it another way, ask you self why an application that only communicates with one device ie the ipoffice is hitting there firewall like sizbut has said get the administrator to tell you what the source and destination addresses are if the destination is anything other than the ipoffice then its not your problem, let him prove its the phone manager...

 

[IPOMonkey]

TLDuk

I will get the administrator to prove it's me.

Wish me luck!

 

[IPOMonkey]

Thanks also Sizbut

 

[intrigrant]

AlfredSpecial,

Lik all IT guys who think they are IT specialists often don't really knows what is going on on their network.
In the following link you can read what is the source of those broadcasts on the network and how to resolve it.

http://www.iss.net/security_center/advice/Exploits/Ports/137/default.htm