What do you make of this, I have tons of calls going to 411 and other numbers, that I’m not making. They are all going to “congestion” but why are they showing up? And its saying “from-sip-external”
Maybe you been hacked ?
The “from-sip-external” is your clue. Time to set up security and change all of your phone passwords.
How do I tell which extension it was?
All of my extensions DO NOT use the same password.
I’m running:
5.211.65-21
They are not coming from any one extension, they are coming from one or more IP address to your server’s external IP address on UDP/5060 and you probably have “allow guest calls” in your sip settings, if you had “security” events being logged, those IP’s would be exposed in said log. You could likely “ban” then with a properly configured fail2ban server. But best to have some rigorous firewall rules set.
Thanks dicko, I’ve changed those settings.