Exchange server Listening on 1241??????

Netstudent

we have a site that was complaining of low throughput and when I checked their circuit with Netflow I saw a very large percentage of their traffic destined for our exchange server on port 1241. Netflow had it mapped to an application named Nessus which is security and vulnerability testing software.
We do not use this.

I know that outlook and exchange use mostly static ports but also use dynamic as well. This article states that it uses randomaly allocated TCP highports. But I do a netstat -a and I have A LOT of users connected to the server on this port. So could this 1241 coincidentally be the random allocation that the windows doc describes?

http://support.microsoft.com/kb/832017


I searched all over the place for info on this port but all I come up with is Nessus and Nessus daemon.

Can anyone confirm the theory of random allocation? If it was random, would I still have a ton of sockets established on this server side port?

sprkymrk

I'm not positive, but I think if you reboot the server, it will then dynamically reallocate another high levle port. I had a similar issue, and it seemed like the port was static. However, after a maintenance reboot the port changed. It was not 1241, but just a 1100-1110 or something.

Netstudent

Ok good to know. Thanks Mark.