So yesterday i start experiencing a weird issue, i start seeing this message everywhere.
[2014-10-12 07:23:48] VERBOSE[30859] asterisk.c: – Remote UNIX connection
[2014-10-12 07:23:48] VERBOSE[15435][C-00001404] netsock2.c: == Using SIP RTP TOS bits 184
[2014-10-12 07:23:48] VERBOSE[15435][C-00001404] netsock2.c: == Using SIP RTP CoS mark 5
[2014-10-12 07:23:48] VERBOSE[15044] asterisk.c: – Remote UNIX connection disconnected
[2014-10-12 07:23:48] WARNING[30872] chan_sip.c: Retransmission timeout reached on transmission [email protected]:5060 for seqno 102 (Critical Request) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
I start diggin around and i then i see that there are actual channels with the weirdest information active. My channels are almost 5 times more than my actual connected calls…
I was thinking i was being hacked and having someone send me a ton of calls, but then realized that i could’ve been hacked and someone placed a program that would excecute X amount of calls that show in the cdr as ‘from-trunk’ with no CLID, and the calls just fall into the WAIT context for 900 and drop.
I realized i had the anonymous option enabled on the system so i disabled it and the messages changed. BUT the calls were still being routed to random trunks, and it was ignoring the incoming route that i did with the numbers it was dialing so it would hangup.
Anyone had this issue before?