Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The Exchange 2010 environment I manage was stood up by a predecessor. One of the two Exchange servers in the environment uses four IPs all from a single NIC.

I'm trying to determine what each of these four IPs are used for and I'm not exactly sure how to find that information. Everything I can find is pointing to a URL and not an IP so I don't know how to determine what each of the IPs do.

Has anybody been in a similar situation before? What did you do to figure this out if there wasn't documentation explaining the reason for each of them?

Thanks in advance!

Edit: After running

 netstat -an | findstr xxx.xxx.xxx.xxx 
I have these additional clues.

IP #1
Listening Ports:
UDP - 137-138
TCP - 139 & random ports from 7xxx-55xxx

IP #2
Listening Ports:
TCP: 443

IP #3
Listening Ports:
TCP: 443 & 3389

IP #4
Listening Ports:
TCP: Random ports from 7xxx-60xxx

Additional Note: IP's #2 and #3 are bound to IIS but I can't find anywhere that states explicitly what one of them is used for vs. the other.

share|improve this question
    
Please tell which Exchange roles are installed on this server. –  Massimo Jun 13 '12 at 20:56
    
Good question...CAS and Transport. The other server in the config has CAS, Transport, and the Mailbox Store (if that helps). –  Windows Ninja Jun 13 '12 at 21:05
add comment

2 Answers 2

up vote 3 down vote accepted

You can try looking in the Exchange Mgmt Console under Server Configuration > Hub Transport > Receive Connectors. We use separate receive connectors/IPs for relay vs non-relay e-mail. You can also try pinging the various hostnames in the URLs you found and see what IPs they resolve to. Similar to what Hyppy said you can run:

netstat -an | findstr x.x.x.x

...for each of the 4 IPs to see what ports they are listening on. Might just be SMTP (25), HTTP (80), HTTPS (443), or something else.

Edit after additional question info:

For IP #2 & #3 listening on 443, you can try just doing https://IP#2 & https://IP#3 to see what you get. You can also open the IIS manager and see if there are multiple websites and what their bindings are to which IP.

You can refer to the Exchange Network Port Reference from Microsoft to try and hunt down specific IP/port combos to try and figure it out that way. You can also take a look at the firewall or network ACLs of some sort to see what traffic is allowed to which IPs on the Exchange server. If logging is enabled, you can parse through the Exchange logs to determine what IPs are connecting to it on which IPs (generally under ...Microsoft\Exchange Server\V14\TransportRoles\Logs).

I guess another way you could approach this situation instead of asking "What are these 4 IPs used for?" is to ask yourself "What do I want these 4 IPs to be used for and do I even need 4 separate IPs to run Exchange the way I want to run it?" Since you have inherited an Exchange org from a previous admin, you are in charge now and can configure it however you want. It is an interesting situation in that there is no easy and simple way to determine what you are trying to determine though...

share|improve this answer
    
The command you gave is a bit more helpful. Going to edit the original question with some more details that I found from that. –  Windows Ninja Jun 13 '12 at 20:37
    
Your edit contains some very useful information, thank you. I won't have a moment to take a closer look at this situation again until Monday but I will likely award you the answer at that point. Thank you for the well thought out and reasoned response. –  Windows Ninja Jun 14 '12 at 23:24
add comment
netstat -ao

This will show all listening ports, by IP (or 0.0.0.0 for all IPs) and their associated executables.

After that, it's time to put your detective cap on.

share|improve this answer
1  
A good start. Also, do a reverse DNS lookup on each of them. Maybe the DNS records will shed some light? –  MDMarra Jun 13 '12 at 19:46
    
DNS entries all just show the server name unfortunately. Appreciate the help though! –  Windows Ninja Jun 13 '12 at 20:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.