The following diagram shows the interactions which take place across various protocols and ports when establishing an H.323 (or Microsoft NetMeeting) call:

This is a direct link to an image included in an Intel document titled The Problems and Pitfalls of Getting H.323 Safely Through Firewalls. The full text (very good background information) can be found at http://www.chebucto.ns.ca/~rakerman/articles/ig-h323_firewalls.html.

The following shows the Q.931 message flow which is used to establish and clear a call. This communication takes place over port 1720.

This is a link to an image which is included in a document titled Q.931 Protocol Overview.

Three of the protocols incorporated into the H.323 framework are Q.931, H.245 and H.225. Go here to register with the ITU. Registration will allow you download up to three recommendations for free. I'm not allowed to make them available on this site, but I don't have to if you can download them for free.

According to the documentation, the H.245 communication takes place over a separate port but the Microsoft documentation indicates that port 1503 is used for T.120 (likely the audio channel) communication. It's my intent to demonstrate that port 1503 is actually the H.245 channel which can also carry the audio portion of a NetMeeting on a logical channel. Stay tuned!