When doing firewall audits (Palo Alto) we used the following query to investigate very strange teams behavior sometimes talking to certain IP addresses on our DMZ which in some cases don't even exist (there's no device there).
The filter in palo alto we are using is: ( rule eq 'Allow Inside to DMZ' ) and ( app eq ms-teams-audio-video )
Palo Alto's Applicaiton layer firewall is detecting lots of random small kbps from users on our regular network to ports 50032, 50010, 50019, 20024, 50030, 50014, 50046, 50050 and a few other in that range. These are regular users trying to hit these IPs:
192.168.1.157 - (no device exists here)
192.168.1.24 - A vendors second VPN to their private network but real traffic would go out their HSRP IP
192.168.1.16 - (no device exists here)
192.168.1.3 - A locked down Windows 10-based KIOSK that faces the public and is locked onto our website
192.168.1.170 - (no device exists here)
192.168.1.199 - An SFTP server
Why would teams be trying to send random bits of data recognized as ms-teams-audio-video to random IP's that sometimes exist, or not exist on our DMZ? These users are not having teams issues, except maybe the random thumbnails are broken images but click off chat to another area, then click back and they are fixed.
