Can't call SIP phone & many Active SIP Channels?

General Help
1

I have an extension (4204) that I can no longer make calls to. The phone never rings or blinks or anything. It does say under Asterisk Info -> Peers that it is registered and has the correct IP address. The user can call from their phone however.

I have run “sip show channels” and I noticed there are over 100 active “NOTIFY” calls to that extension. “sip show inuse” doesn’t yield anything related. They all appear to be a Tx: NOTIFY. Asterisk 1.8 with Freepbx 2.10.1.9

I don’t want to restart the server because that will cut off all the current calls.

Here is a log from “sip show channels” (the Peer IP addresses don’t exist):

Peer User/ANR Call ID Format Hold Last Message Expiry Peer
172.26.2.87 4204 1698533301-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 227101333-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 1422976095-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 431569866-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 1834346884-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 867410640-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.1.104 (None) 1569526570-5060 0x0 (nothing) No Rx: REGISTER
172.26.2.10 4204 2099342036-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 1218093605-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 301660230-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.0.230 2622158435 5a82bbf2414b7f6 0x4 (ulaw) No Tx: ACK Charter
172.26.2.87 4204 1427381886-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 1619550037-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.87 4204 1543417714-5060 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 859963924-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 1848707484-5060 0x0 (nothing) No Tx: NOTIFY
172.26.3.13 4392 3f08208675e69b4 0x4 (ulaw) No Init: INVITE 4392
172.26.2.10 4204 585752514-5060- 0x0 (nothing) No Tx: NOTIFY
172.26.2.10 4204 454709105-5060- 0x0 (nothing) No Tx: NOTIFY

2

You give no details about your deployment so little explicit help can be given, given that here is some theory:-

your connections from 172.26.0.0/16 are theoretically private IP addresses (reference RFC 1918) and should not be route-able. You need to investigate your network to see who is claiming to use those addresses tcpdump and tehn arp can help you there.

You can use asterisk’s soft-hangup method

channel request hangup all

on these connections to start clean , but I suspect that you either have a rogue network/device out there or possibly you have been compromised an the compromise vector is spoofing the IP addresses. First step might be to

sip debug peer 4204

after the channels are cleared.