Avaya AES unidentified traffic being sourced from AES box

[wterstegen]

All,

I hope somebody here can help us identify and hopefully stop the traffic we see coming from an AES box we have.

First of all, I have no experience with Avaya. I am a network admin and the voip system has always been under management by external parties.

Recently we have added additional logging which showed that traffic (syn packets) from our AES was hitting our firewal. The AES constantly tries to setup a session with 192.168.42.1 on port 10001.

We have asked our 3rd party who manages our system to look into it but without luck. Also Avaya support have gone through all configurations and could not say what this is and how to disable it.

Only thing they could mention is that the IP 192.168.42.1 is the default IP for another Avaya product, IP Office if I can recall correctly. But that product we have never used in our environment.

I hope somebody here can provide us with more info and knows how to stop this.

Thank you in advance,

Wim Terstegen

[mittas]

you can check network configuration of AES server, IF configured any

[wterstegen]

Hi Mittas,

Unfortunately our 3rd party and Avaya support have gone through all the configurations on that box, and they say they cannot find any configuration linked to it. But they can also not tell me what it is the AES tries to do.

It is not a real issue, traffic is blocked but it clogs up my logging as it tries to setup this session every 30 seconds.

I also found another topic about same situation, and they just blocked it on the box (adding rule in iptables on AES) but my hope was that somebody on these forums was familiar with it and could explain more instead of just blocking traffic. I find it strange that even Avaya does not know what their product does

[wterstegen]

nobody who knows what this AES tries to do? peculiar, even Avaya themselves don't know what their product does. No related config to be found but still it tries to setup some connection.

And an answer like, just block it is very unsatisfying.

[sumit007]

Take Sniffers. It will help you for Sure.

[yadav29]

sniffer traces would give you the best idea, you can filter via 192.168.42.1 where you were getting lots of traffic on firewall.