Random call from extension that doesn't exist


Since today I’ve got random calls on my extension 200 from 1002 but there isn’t an extension called 1002.
I checked my Asterisk Logfiles & CDR Report but there isn’t any information about 1002?

The strangest thing, extension 200 has DND mode on and it will be ring time after time

What make/model of phone is having the problem? I had the same issue with Grandstream which turned out to be it registering to its mothership…

On the PBX, start up ‘tcpdump -i eth0 host <IP of Phone>’ and see if there’s any traffic from the PBX to the phone. If that doesn’t do the trick, you might need to look at your network and see if someone, somewhere, is calling your extension using a direct “SIP” address. Doing a line capture that allows you to monitor the IP address of the phone will be required for this to work. This could be a problem with a bad machine on your network, someone playing around with a softphone, or someone outside your network ringing the phone.

If your DND is set on the server (and not on the phone), the DND setting will be ignored on a direct call to the extension from outside, so I’d probably start with the network checks. FMFM is the same deal - FMFM is a server function, not a phone function.

check if upnp is turned on in your router - if yes turn it off

I’ve got a Grandstream GXP2160

I turned it off

The Grandstreams I had with the problem were fixed by disabling the cloud account which comes enabled by default. After that, random calls from extension 1001, 1002 stopped.

Where can I disable a cloud account?

It’s been a long time since I’ve used those grandstreams, but I believe it just came preconfigured with an account that registered to grandstream.

There isn’t any traffic from the PBX to the phone. Any suggestions how I can find if there is a bad machine?

Once you are convinced this is not a PBX issue, the most likely explanation is that your phone is using port 5060 locally for SIP. Certain routers will leave that port open allowing malicious SIP packets from the internet to your phone. You can configure the phone (not the pbx) to use a different SIP port or the phone may have security settings you can enable so that it only accepts SIP packets from hosts to which it’s registered.

for what itis worth, we have found that if upnp is enabled on the router and someone is playing games (i.e xbox) ports get opened. disabling upnp fixed the problem in a couple of sites

1 Like

Turning off upnp on a Netgear router fixed this problem that was driving everybody crazy. Thanks Bob.

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.