outing traffic from 3cx to external address

[mart3cx]

Hi,

i have a problem. The 3cx server is permanently connecting to an extern ip-address on port 80.

This is a website which has nothing to do with voip or 3cx. When i stop the 3cx services the traffic stops also.

No maleware or virus was found on the server. The anyone know what this is?

TX
Mart

 

[leejor]

This is a website which has nothing to do with voip or 3cx.

So what site does the IP translate to? Port 80 is usually used as a HTP port.

 

[mhanson]

Can you be a little more clear?

So your 3CX is attempting to reach an external IP/Web Site? Can you post some logs or details? How did you discover this? Do you see any kind of effects on system performance?

Please try to include as much information as possible, as this is a very vague questions, that could have limitless answers. The more you give us, the easier it is for us to try an help :mrgreen:

 

[mart3cx]

Hi all,

our server is going to h t t p : / / a d m i n . v m g l g . c o m / with http.

Whe have checked this with internal monitoring tools on the switches and also the firewall has logged the same.

In the 3CX logs is no entry which shows this traffic. But when we stop all 3cx services the traffic stops also.


There was no virus and no maleware found in the server. The server is w2003 on a virtual machine.

We use V9 SP5 (until yesterday we used SP4).

At the moment the traffic is stopped. It were about 500Mb a day.

The performance is now a little bit better - before the traffic stopped the quality of calls was not so good.

Thats all information i have at the moment.

TX
Martin

 

[SY]

Another question.
Are you sure that 3CX Phonesystem tried to access that server and it was not vice versa?

Thanks

 

[mart3cx]

I can not say which site is starting the traffic.

The traffic I can see is the traffic from 3CX to the other server....

But maybe a virus?

 

[SY]

I can not say which site is starting the traffic.

The traffic I can see is the traffic from 3CX to the other server....

What was the connection point (IPort) on the host where 3CX Phonesystem is running?

 

[mart3cx]

at the moment we have connections to VWP0910.WEBPACK.HOSTEUROPE.DE 87.230.63.149:80 and to VERISIGN 199.7.71.190:80.

We had also connections to the dns-name in first entry on port 57863 - this has stopped now.

tx

 

[SY]

run
netstat -ano
from command line.
this utility will provide you information about all active network connections (local and foreign addresses, ports, PID of owner etc.)
Using PID, you can find more information about concrete process in Task manager.

I'm sure, that PBX doesn't make connections to external resources. There is only one exception - management console checks updates at startup. It obtains brief information about updates available on the server. Connection is not persistent and only small amount of data is downloaded (few kilobytes).

 

[nb]

Also you cannot stop one service at a time and see which service stops this traffic?

Start from IIS first or the web server.

 

[t332]

My "3CX Phone System v10.0.18611.1558" make connections to 87.230.63.149:80 too. =(

If I stopped 3CX server - traffic stopped too.

Seems, traffic to this host started when I'm make connection to 3CX web-interface.

 

[SY]

My "3CX Phone System v10.0.18611.1558" make connections to 87.230.63.149:80 too. =(

If I stopped 3CX server - traffic stopped too.

Seems, traffic to this host started when I'm make connection to 3CX web-interface.

Could you please read all messages in this topic?

at the moment we have connections to VWP0910.WEBPACK.HOSTEUROPE.DE 87.230.63.149:80 ...

...PBX doesn't make connections to external resources. There is only one exception - management console checks updates at startup. It obtains brief information about updates available on the server. Connection is not persistent and only small amount of data is downloaded (few kilobytes).

 

[t332]

Sorry. I do not understand what this phrase refers to this IP-address. I read again and no question now. =)
Thank you.

 

[Bamit]

I see this was asked about 2-1/2 years ago. Has anyone ever answered this question?

Our firewall system records that the 3CX server makes quite a few connections a day to this address.

Thanks.
.