Here's an email from an internal mailer along this subject line from a while back that may be useful.
=========================
The Skinny traffic uses TCP and binds to port 2000 on the CM side (for all Unity devices) and ports between 1024 and 5000 (one per Unity device) on the Unity side. I've seen it start at port 3000 (on the Unity) and build up one per device, but these are assigned by the OS. They're guaranteed to be between 1024 and 5000. You might try `netstat` to see if they're always ports 3000+ or if that's just my box.
The RTP traffic uses UDP and binds to ports starting at 22800 on the both the Unity side and the phone side. (RTP data is sent directly between endpoints, not through the CCM). There is a separate RTP connection for each audio direction (incoming and outgoing) for each active device. These are reallocated as needed, so you'll only have active UDP ports to correspond to the active Unity devices.
Thus, for each Unity device, one TCP socket is always active, and two UDP ports will be used on each side of the connection when needed. `netstat` and `netstat -a` should illustrate this on a test box.
Also note that each side of the connection has it's own port. Like when you
surf the web, you connect to the "well known" port 80 on the http server,
but your browser binds to a local port which is likely to be above 1024 (it
is assigned by the OS, since it doesn't need to be a "well known" port on
the client.)
Other possible ports:
UDP 16384-32767 for RTP streams unity<->voice terminating device
(phone/gateway)
TCP 143 for communication from unity<->exchange IMAP
TCP 389 for communication from unity<->exchange LDAP directory
TCP 137-139 for any SMB communication from unity<->exchange server
(copy files to/from remote share \\server\share )
