We’ve recently installed a new Barracuda Firewall…everything seems to be running fine but have noticed some strange traffic… Looking at ‘Recent Connections’ in the firewall I see hundreds of attempts where the source is the IP of my pbx and the destination is 192.168.5.xxx where xxx is random… we have nothing on our network in .5 nor have we ever…so I’m wondering why the pbx is trying to send this traffic…
any help is greatly appreciated!
You could start off with
tcpdump -nnv net 192.168.5.0/24
that will be all traffic
tcpdump -nnv net 192.168.5.0/24 and port 5060
will be default sip traffic.
If you see anything untoward then fix it .
Hi, Thanks for the quick response! I’ve figured out that the IP’s I’m wondering about are actually the IP’s of workstations in remote offices…
we have an offshore CC who register their softphones (xlite) on my PBX… that is the only connection between the offices as they have their own network etc…
So I guess my question now is should my pbx be involved in this traffic? I have other offshore CC’s (setup is the same) for which I don’t see any of this type of traffic