Exchange server sending strange traffic - UDP ports

I am seeing some really strange things on my network.  According to my firewall logs, it looks as if my exchange server is attempting to connect to random IP addresses in the private network ranges that are outside of my internal private network ranges.  The only commonality is what ports the Exchange system is sending out on.  I see the traffic on port 1418, 1475, 1659, and a couple other ports.  The issue started towards the end last month, around the 25th if I am not mistaken.  As far as I am aware, there have been no updates or software packages recently installed on this system.  I cannot find any processes that would be causing these issues either.  My virus definitions are up to date, and there was a full system scan run this past Sunday without any issues found&  I have run WireShark on the Exchange server and I see the traffic in the packet capture.  I need to get this resolved ASAP.
warewolsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

marcustechCommented:
try run

netstat -b -v
to show the process that a creating the connections.

If that doesn't shed any light on the situation, post them here and I'll have a look for you.

Exchange shouldn't be making any UDP connections.
0
marcustechCommented:
(run that from CMD on the server - I forgot to mention)
0
warewolsAuthor Commented:
I have attached the netstat command's output.  I am going through it myself right now...  Thanks for your help.
info.txt
0
TimMalleryCommented:
Are you using EMC Legato Software? Some of this traffic seems associated with that.
0
warewolsAuthor Commented:
After talking to Microsoft last night, this is a normal operation of the email server.  The port that I was seeing is just an arbitrary port that was chosen on the server for email traffic, on the the servers chose 1418 (assigned to Timbuktu in the RFC listings) to start the store.exe process.  Store.exe picks a port by finding the next available open port that is above port number 1024.

The reason we are seeing the traffic appear in the logs is because of malformed packets coming from the clients attempting to connect to the email server.  We are seeing the traffic coming in on a valid IP address (internal and external) and then attempting to go out to a private IP address outside the range of the internal private IP addresses.  The tech from Microsoft stated that these malformed packets could be coming from anywhere that has a NAT translation in place.  Some of the packets we inspected that were going to the unusual IP addresses showed MAC addresses for AirPort wireless APs, a Sonic firewall, and also a LINKSYS router.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.