Earlier, I received two calls from the IP of the FreePBX server. Having checked FreePBX, I discover that Fail2ban had blocked the IP of the phone (Sangoma S700) in which the “phanton” call came through.
Have I been hacked?
This has just happened again! The main ring group with all the extensions on (a mixture of S300, S500, S700 and DAHDI) just randomly started ringing with the IP address of the FreePBX server displayed on the screen! When the call is answered, it hangs up.
What is going on?
Logs - we need to see the call in the logs.
You’ll want to start with the /var/log/asterisk/full log and see what you can find. I understand that you might not know what you’re looking for, but if you post it, make sure you limit it to stuff that’s pertinent. Making it easier for us gets us to the answer faster.
Having just had this happen AGAIN, I immediately checked the logs.
[2017-04-14 15:41:12] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:13] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:13] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:15] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:15] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:16] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:16] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:18] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:18] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:19] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:19] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:21] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:21] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:22] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:22] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:24] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:24] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:25] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:25] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:27] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:27] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:28] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:28] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:30] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:30] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:31] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 is ringing
[2017-04-14 15:41:31] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/2-1 is ringing
[2017-04-14 15:41:31] VERBOSE[26137][C-0000002a] app_dial.c: DAHDI/1-1 answered DAHDI/4-1
[2017-04-14 15:41:31] VERBOSE[26137][C-0000002a] sig_analog.c: Hanging up on 'DAHDI/2-1'
[2017-04-14 15:41:31] VERBOSE[26137][C-0000002a] chan_dahdi.c: Hungup 'DAHDI/2-1'
I have an analogue phone connected to the FXO port feeding FreePBX and this did not ring. A bug in DAHDI?
Thanks
That log snippet is not helpful apart from confirming what you already know, that your phones are ringing. Try grabbing the entire call with:
grep "\[C-0000002a\]" /var/log/asterisk/full*