Phantom call record from internal non-existing extensions

General Help
1

Hi:

I see a lot of phantom call records (see below) from the non-existing internal extensions. When I searched in /var/log/asterisk/full, I do not see any.

I have the following situation:

  1. Asterisk 1.6 with FreePBX 2.9.5 running behind NAT with public IP address.

  2. The RTP ports from 10000 to 20000 is forwarded (DNAT) to the Asterisk server.

  3. Fail2ban is activated for Asterisk (http://www.fail2ban.org/wiki/index.php/Asterisk) and 'Allow Anonymous Inbound SIP Calls?: ’ is set to ‘no’ (earlier yes, but things didn’t change)

I searched over the internet and could not find anything, but a notion that somebody is trying to get into the system (http://forums.whirlpool.net.au/archive/1146552).

What does it mean and how to get rid of the never ending lists of phantom calls that appears in the FreePBX CDR? Thanks!

-Call Logs-

  1.  2013-05-13 20:50:29 	SIP/81.216... 	700 	"700" <700> 	s 	ANSWERED 	2

  2.  2013-05-13 20:50:28 	SIP/81.216... 	700 	"700" <700> 	s 	ANSWERED 	0

  3.  2013-05-13 20:50:25 	SIP/81.216... 	700 	"700" <700> 	s 	ANSWERED 	1

  4.  2013-05-13 20:50:24 	SIP/81.216... 	700 	"700" <700> 	s 	ANSWERED 	0

  5.  2013-05-13 20:50:22 	SIP/81.216... 	700 	"700" <700> 	s 	ANSWERED 	1

  6.  2013-05-13 20:30:28 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	1

  7.  2013-05-13 20:30:26 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	1

  8.  2013-05-13 20:30:24 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	0

  9.  2013-05-13 20:30:23 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	0

  10. 2013-05-13 20:30:22 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	0

  11. 2013-05-13 20:30:20 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	1

  12. 2013-05-13 20:30:18 	SIP/81.216... 	100 	"100" <100> 	s 	ANSWERED 	0

  13. 2013-05-13 20:07:54 	SIP/81.216... 	555 	"555" <555> 	s 	ANSWERED 	0

  14. 2013-05-13 20:07:52 	SIP/81.216... 	555 	"555" <555> 	s 	ANSWERED 	1

  15. 2013-05-13 20:07:45 	SIP/81.216... 	555 	"555" <555> 	s 	ANSWERED 	5

  16. 2013-05-13 18:00:56 	SIP/81.216... 	401 	"401" <401> 	s 	ANSWERED 	1

  17. 2013-05-13 18:00:55 	SIP/81.216... 	401 	"401" <401> 	s 	ANSWERED 	0

  18. 2013-05-13 18:00:52 	SIP/81.216... 	401 	"401" <401> 	s 	ANSWERED 	0

  19. 2013-05-13 18:00:51 	SIP/81.216... 	401 	"401" <401> 	s 	ANSWERED 	0

  20. 2013-05-13 18:00:48 	SIP/81.216... 	401 	"401" <401> 	s 	ANSWERED 	0

  21. 2013-05-13 16:48:29 	SIP/81.216... 	444 	"444" <444> 	s 	ANSWERED 	1

  22. 2013-05-13 16:48:27 	SIP/81.216... 	444 	"444" <444> 	s 	ANSWERED 	1

  23. 2013-05-13 16:48:25 	SIP/81.216... 	444 	"444" <444> 	s 	ANSWERED 	1

  24. 2013-05-13 14:58:22 	SIP/81.216... 	501 	"501" <501> 	s 	ANSWERED 	1

  25. 2013-05-13 14:58:20 	SIP/81.216... 	501 	"501" <501> 	s 	ANSWERED 	1

  26. 2013-05-13 14:58:17 	SIP/81.216... 	501 	"501" <501> 	00441314634838 	ANSWERED 	1
2

Bump!!

3

Coincidentally

http://www.freepbx.org/forum/general-help/phantom-extensions-placing-calls

4

Just ignore it or set allow guests=no if your trunks will still work with that setting. Allowguests=no is NOT the same setting as Allow Anonymous=no.