up vote 0 down vote favorite
share [g+] share [fb]

I'm seeing a lot of traffic going to my Exchange 2003 server from client machines on TCP port 1499. (The reason they are traversing the firewall is because the clients are at remote site connected via site-to-site VPN.)

It doesn't appear in the standard list of Exchange ports.

We are using Riverbed to compress traffic between the sites - but this isn't a Riverbed port either - I'm seeing some port 7830 (Riverbed MAPI) traffic but nothing is in their documentation for this port.

We also use RPC/https - but this isn't relevant as far as I know, as I assume this is just using 443.

Anybody know what port 1499 is? (Have googled it, but it comes back as Federico Heinz Consultora - no idea what that is!)

link|improve this question
77% accept rate
Also Ports 1235 and 1257. – Ben Aug 31 '11 at 16:04
feedback

3 Answers

up vote 1 down vote accepted

There are no known products that currently use this port or attacks or probes that use this port for any reason. I would look for any pattern in the source IP addresses.

Update: Oh, Exchange RPC/HTTPS doesn't use port 443 unless you specifically configured it to. It uses whatever port is configured, possibly even a dynamically selected port. This may be your issue.

link|improve this answer
Can't see a pattern in the IPs - seems to be a few random clients. Think I may go for the "scream test" - drop the traffic and see who shouts! – Ben Aug 31 '11 at 16:05
Do you have anything listening on these ports? – David Schwartz Aug 31 '11 at 16:06
No - not as far as I know. The only thing that flagged it was seeing the fw traffic. – Ben Aug 31 '11 at 16:09
If nothing's listening to it, then I say either block it or forget about it, depending on your organization's policy. – David Schwartz Aug 31 '11 at 16:10
feedback
up vote 1 down vote

That port is in the range that it could be used by RPC communication to your mailbox server from the client trying to initiate a direct connection to the mailbox server.

Even though you have set up on the server Outlook anywhere (RPC/HTTPS) the client doesn't always behave right (outlook 2010 I am looking at you)

You should be able to safely filter the traffic. If people complain then your RPC/HTTPS configuration isn't correct on the clients.

link|improve this answer
feedback
up vote 0 down vote

Sniffing the traffic wouldn't be a bad idea either. Wireshark is your friend, especially if you have a switch that can port mirror.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.