Since today I’ve got random calls on my extension 200 from 1002 but there isn’t an extension called 1002.
I checked my Asterisk Logfiles & CDR Report but there isn’t any information about 1002?
The strangest thing, extension 200 has DND mode on and it will be ring time after time
On the PBX, start up ‘tcpdump -i eth0 host <IP of Phone>’ and see if there’s any traffic from the PBX to the phone. If that doesn’t do the trick, you might need to look at your network and see if someone, somewhere, is calling your extension using a direct “SIP” address. Doing a line capture that allows you to monitor the IP address of the phone will be required for this to work. This could be a problem with a bad machine on your network, someone playing around with a softphone, or someone outside your network ringing the phone.
If your DND is set on the server (and not on the phone), the DND setting will be ignored on a direct call to the extension from outside, so I’d probably start with the network checks. FMFM is the same deal - FMFM is a server function, not a phone function.
The Grandstreams I had with the problem were fixed by disabling the cloud account which comes enabled by default. After that, random calls from extension 1001, 1002 stopped.
Once you are convinced this is not a PBX issue, the most likely explanation is that your phone is using port 5060 locally for SIP. Certain routers will leave that port open allowing malicious SIP packets from the internet to your phone. You can configure the phone (not the pbx) to use a different SIP port or the phone may have security settings you can enable so that it only accepts SIP packets from hosts to which it’s registered.
for what itis worth, we have found that if upnp is enabled on the router and someone is playing games (i.e xbox) ports get opened. disabling upnp fixed the problem in a couple of sites