Skype for Business clients try to connect to unknown private IP - Microsoft Community

split thread.

i experiencing similar behavior, our main issue surrounding video sharing.  we seeing traffic 10.236.60.x network, not part of our ip scheme.  here trace on 1 of packets.  the traffic identified stun protocol.

frame 490: 150 bytes on wire (1200 bits), 150 bytes captured (1200 bits)
    encapsulation type: ethernet (1)
    arrival time: jul 11, 2017 13:02:53.012263000 central daylight time
    [time shift packet: 0.000000000 seconds]
    epoch time: 1499796173.012263000 seconds
    [time delta previous captured frame: 0.059910000 seconds]
    [time delta previous displayed frame: 0.059910000 seconds]
    [time since reference or first frame: 1832511.633615000 seconds]
    frame number: 490
    frame length: 150 bytes (1200 bits)
    capture length: 150 bytes (1200 bits)
    [frame marked: false]
    [frame ignored: false]
    [protocols in frame: eth:ethertype:vlan:ethertype:ip:udp:stun]
    [coloring rule name: udp]
    [coloring rule string: udp]
ethernet ii, src: ciscoinc_ff:fc:04 (00:08:e3:ff:fc:04), dst: paloalto_00:01:30 (00:1b:17:00:01:30)
    destination: paloalto_00:01:30 (00:1b:17:00:01:30)
        address: paloalto_00:01:30 (00:1b:17:00:01:30)
        .... ..0. .... .... .... .... = lg bit: globally unique address (factory default)
        .... ...0 .... .... .... .... = ig bit: individual address (unicast)
    source: ciscoinc_ff:fc:04 (00:08:e3:ff:fc:04)
        address: ciscoinc_ff:fc:04 (00:08:e3:ff:fc:04)
        .... ..0. .... .... .... .... = lg bit: globally unique address (factory default)
        .... ...0 .... .... .... .... = ig bit: individual address (unicast)
    type: 802.1q virtual lan (0x8100)
802.1q virtual lan, pri: 0, cfi: 0, id: 990
    000. .... .... .... = priority: best effort (default) (0)
    ...0 .... .... .... = cfi: canonical (0)
    .... 0011 1101 1110 = id: 990
    type: ipv4 (0x0800)
internet protocol version 4, src: 10.10.138.155, dst: 10.236.60.59
    0100 .... = version: 4
    .... 0101 = header length: 20 bytes (5)
    differentiated services field: 0x00 (dscp: cs0, ecn: not-ect)
        0000 00.. = differentiated services codepoint: default (0)
        .... ..00 = explicit congestion notification: not ecn-capable transport (0)
    total length: 132
    identification: 0x65a7 (26023)
    flags: 0x02 (don't fragment)
        0... .... = reserved bit: not set
        .1.. .... = don't fragment: set
        ..0. .... = more fragments: not set
    fragment offset: 0
    time live: 126
    protocol: udp (17)
    header checksum: 0xbaf5 [validation disabled]
    [header checksum status: unverified]
    source: 10.10.138.155
    destination: 10.236.60.59
    [source geoip: unknown]
    [destination geoip: unknown]
user datagram protocol, src port: 50050, dst port: 64076
    source port: 50050
    destination port: 64076
    length: 112
    checksum: 0xac1a [unverified]
    [checksum status: unverified]
    [stream index: 53]
session traversal utilities nat
    [duplicated original message in: 474]
    message type: 0x0001 (binding request)
        .... ...0 ...0 .... = message class: 0x00 request (0)
        ..00 000. 000. 0001 = message method: 0x0001 binding (0x001)
        ..0. .... .... .... = message method assignment: ietf review (0x0)
    message length: 84
    message cookie: 2112a442
    message transaction id: 14ec3d297b32371f2f94d72b
    attributes
        username: y5fl:ogn8
            attribute type: username (0x0006)
                0... .... .... .... = attribute type comprehension: required (0x0)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 9
            username: y5fl:ogn8
            padding: 3
        priority
            attribute type: priority (0x0024)
                0... .... .... .... = attribute type comprehension: required (0x0)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 4
            priority: 1862004479
        ice-controlling
            attribute type: ice-controlling (0x802a)
                1... .... .... .... = attribute type comprehension: optional (0x1)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 8
            tie breaker: 0000000005bcceff
        ms-candidate-identifier
            attribute type: ms-candidate-identifier (0x8054)
                1... .... .... .... = attribute type comprehension: optional (0x1)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 1
            foundation: 9
        ms-implementation-version: ms-ice2 sha256
            attribute type: ms-implementation-version (0x8070)
                1... .... .... .... = attribute type comprehension: optional (0x1)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 4
            ms version: ms-ice2 sha256 (3)
        message-integrity
            attribute type: message-integrity (0x0008)
                0... .... .... .... = attribute type comprehension: required (0x0)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 20
            hmac-sha1: 9abe34ee7768605e1078020b4c600c8b93ad3bef
        fingerprint
            attribute type: fingerprint (0x8028)
                1... .... .... .... = attribute type comprehension: optional (0x1)
                .0.. .... .... .... = attribute type assignment: ietf review (0x0)
            attribute length: 4
            crc-32: 0x483fb712

thanks, beginning think imagining it. 

bruce

Office / Skype for Business / Other/unknown