asterisk users - Oct 2007 - Asterisk sends packets on 8004/udp

For the life of me can't figure out why the Asterisk server generates an
enormous quantity of outgoing packets on port 8004/udp. They seem to have no
effect whether they are blocked by the firewall or not.
We're running SIP. Everything appears to be OK (except a large number of
ChanSpy write buffer overflow messages, which I also don't understand).
How can I discover whether these packets are desirable or not? What should I
do with them? I have found no documentation on port 8004.
Thanks in advance,
Yitzhak Bar Geva
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20071023/04717ec0/attachment.htm

>
> For the life of me can't figure out why the Asterisk server generates
an
> enormous quantity of outgoing packets on port 8004/udp. They seem to have
no
> effect whether they are blocked by the firewall or not.
> We're running SIP. Everything appears to be OK (except a large number
of
> ChanSpy write buffer overflow messages, which I also don't understand).
> How can I discover whether these packets are desirable or not? What should
> I do with them? I have found no documentation on port 8004.
> Thanks in advance,
> Yitzhak Bar Geva
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20071023/7d768437/attachment.htm

On 10/23/07, Yitzhak Bar Geva <yitzhakbg at gmail.com>
wrote:
>
> For the life of me can't figure out why the Asterisk server generates
an
> enormous quantity of outgoing packets on port 8004/udp. They seem to have
no
> effect whether they are blocked by the firewall or not.
> We're running SIP. Everything appears to be OK (except a large number
of
> ChanSpy write buffer overflow messages, which I also don't understand).
> How can I discover whether these packets are desirable or not? What should
I
> do with them? I have found no documentation on port 8004.
> Thanks in advance,
> Yitzhak Bar Geva
>
The only normal service on port 8004 I've found documentation on is
Shoutcast (icecast), and people do sometimes configure Asterisk to use
shoutcast streams for music on hold.  Other than that, most of the
rest of the info on 8004 (on Google anyways) is about a remotely
accessible exploit again certain Symantec anti-virus engines.  So if
it isn't a shoutcasted audio stream you've forgotten about, you might
want to check if your server has been compromised and is being used to
scan the rest of the net for vulnerable Symantec software or something
like that.

-- Brandon