[asterisk-users] Asterisk sends packets on 8004/udp

[Brandon Black]

On 10/23/07, Yitzhak Bar Geva <yitzhakbg at gmail.com> wrote:
>
> For the life of me can't figure out why the Asterisk server generates an
> enormous quantity of outgoing packets on port 8004/udp. They seem to have no
> effect whether they are blocked by the firewall or not.
> We're running SIP. Everything appears to be OK (except a large number of
> ChanSpy write buffer overflow messages, which I also don't understand).
> How can I discover whether these packets are desirable or not? What should I
> do with them? I have found no documentation on port 8004.
> Thanks in advance,
> Yitzhak Bar Geva
>

The only normal service on port 8004 I've found documentation on is
Shoutcast (icecast), and people do sometimes configure Asterisk to use
shoutcast streams for music on hold.  Other than that, most of the
rest of the info on 8004 (on Google anyways) is about a remotely
accessible exploit again certain Symantec anti-virus engines.  So if
it isn't a shoutcasted audio stream you've forgotten about, you might
want to check if your server has been compromised and is being used to
scan the rest of the net for vulnerable Symantec software or something
like that.

-- Brandon