H.323 endpoints shouting for a gatekeeper — multicast discovery, the step before RAS registration on 1719.
An H.323 endpoint that has not been told where its gatekeeper is sends a GRQ (Gatekeeper Request) to the multicast group 224.0.1.41 on UDP 1718; a gatekeeper that wants the endpoint answers with a GCF, after which all RAS traffic — registration, admission, bandwidth — moves to unicast UDP 1719 and call signalling to TCP 1720. IANA registers 1718 to ITU-T for both TCP and UDP, but the discovery exchange is UDP only. It appears on VoIP networks running legacy H.323 gear: video conferencing MCUs, gateways, and older IP phones.
Do not expose
Gatekeeper discovery is unauthenticated by design and is a link-local mechanism — an endpoint that accepts a GCF from a stranger has just been told where to send its calls, so keep it inside the voice VLAN.
$ nmap -sU -p 1718 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.