0

I'm seeing a lot of traffic going to my Exchange 2003 server from client machines on TCP port 1499. (The reason they are traversing the firewall is because the clients are at remote site connected via site-to-site VPN.)

It doesn't appear in the standard list of Exchange ports.

We are using Riverbed to compress traffic between the sites - but this isn't a Riverbed port either - I'm seeing some port 7830 (Riverbed MAPI) traffic but nothing is in their documentation for this port.

We also use RPC/https - but this isn't relevant as far as I know, as I assume this is just using 443.

Anybody know what port 1499 is? (Have googled it, but it comes back as Federico Heinz Consultora - no idea what that is!)

Improve this question
1
  • Also Ports 1235 and 1257.
    – Ben
    Aug 31, 2011 at 16:04

3 Answers 3

Reset to default
1

There are no known products that currently use this port or attacks or probes that use this port for any reason. I would look for any pattern in the source IP addresses.

Update: Oh, Exchange RPC/HTTPS doesn't use port 443 unless you specifically configured it to. It uses whatever port is configured, possibly even a dynamically selected port. This may be your issue.

Improve this answer
4
  • Can't see a pattern in the IPs - seems to be a few random clients. Think I may go for the "scream test" - drop the traffic and see who shouts!
    – Ben
    Aug 31, 2011 at 16:05
  • Do you have anything listening on these ports?
    – David Schwartz
    Aug 31, 2011 at 16:06
  • No - not as far as I know. The only thing that flagged it was seeing the fw traffic.
    – Ben
    Aug 31, 2011 at 16:09
  • If nothing's listening to it, then I say either block it or forget about it, depending on your organization's policy.
    – David Schwartz
    Aug 31, 2011 at 16:10
1

That port is in the range that it could be used by RPC communication to your mailbox server from the client trying to initiate a direct connection to the mailbox server.

Even though you have set up on the server Outlook anywhere (RPC/HTTPS) the client doesn't always behave right (outlook 2010 I am looking at you)

You should be able to safely filter the traffic. If people complain then your RPC/HTTPS configuration isn't correct on the clients.

Improve this answer
0

Sniffing the traffic wouldn't be a bad idea either. Wireshark is your friend, especially if you have a switch that can port mirror.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .