LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?
2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00
it rings every 10 minutes
Quote from: Esperanto on November 14, 2014, 07:23:20 AM
LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?
2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00
Do you have an external trunk connected to a telecome provider? Can inbound external calls reach your system? It could be a auto-dialer from an external source. Another possibility is that you have accidentally created or triggered a 'rogue' telecom scenario or possibly created a scenario that accidentally calls the main call group every 10 mins.
Just some ideas....
All the best
Andy
Do you have an extension with a very simple password, that might have been hacked?
BR Stefan
whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.
Fortunately it seems to have stopped ringing after a few reboots.
I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom
2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01
Quote from: Esperanto on November 21, 2014, 02:33:26 PM
whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.
Fortunately it seems to have stopped ringing after a few reboots.
I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom
2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen. If they do with the external trunk to your telecom provider disabled then you know that the cause is something internal to your system.
All the best
Andy
Quote from: totallymaxed on November 22, 2014, 12:36:14 PM
Quote from: Esperanto on November 21, 2014, 02:33:26 PM
I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.
doesn't that previous message already answers that option?
Quote from: Esperanto on November 24, 2014, 11:28:43 AM
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.
doesn't that previous message already answers that option?
Actually it does...I hadn't noticed you mentioned disabling your provider. Glad the rings have stopped...and I hope they don't return! Does the log still show similar call activity now?
All the best
Andy
Quote from: totallymaxed on November 24, 2014, 02:11:58 PMDoes the log still show similar call activity now?
Actually it does. Any ideas what might cause it?
2014-11-24 17:00:42 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:54:42 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:46:34 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:45:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-24 16:38:16 SIP 123456 Answer s ANSWERED 00:00
2014-11-24 16:34:15 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:32:12 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:28:30 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:26:25 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:19:48 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:19:47 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:18:42 SIP 27 Answer s ANSWERED 00:01
2014-11-24 16:17:49 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:14:12 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:14:11 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:13:06 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:08:48 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:08:27 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:08:26 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:04:03 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:03:46 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 15:59:01 SIP 102 Answer s ANSWERED 00:00
2014-11-24 15:57:14 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:57:13 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:56:17 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 15:51:42 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:51:41 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:49:10 SIP 102 Answer s ANSWERED 00:00
Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.
Regards,
Josh
Quote from: lemming86_au on November 25, 2014, 05:16:13 AM
Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.
Regards,
Josh
Hmmm...well I don't think that can be it as he's disabled his telecom VOIP service provider. I guess they could be stupid hackers who can hack in but are too lazy to see if there's a working trunk/voip provider though!
...Esperanto why don't you run your Core for a period without a WAN side connection and see if the logs still indicate telecom activity?
All the best
Andy
Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.
The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.
If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.
Regards,
Josh
Quote from: lemming86_au on November 25, 2014, 10:50:12 AM
Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.
The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.
If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.
Regards,
Josh
Agreed re it not needing a configured trunk. That's why i suggested disabling his WAN side connection to see if the call traffic went away.
All the best
Andy
Quote from: totallymaxed on November 25, 2014, 11:18:28 AM
That's why i suggested disabling his WAN side connection to see if the call traffic went away.
That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging? ;)
2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01
same thing happened to me as far as I can see.
I had an extension used by a Siemens gigaset phone with password "12345" when I changed that password, the ringing stopped. so if I not total misunderstood, asterisk is open for communication to the extensions if you know the password and ID.
BR Stefan
Quote from: Esperanto on November 26, 2014, 09:42:31 AM
That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging? ;)
2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01
Well it looks like ladekribs who posted about his issue with Gigasets might have a solution for you...but it depends if your using Gigasets I guess. His issue does seem similar to your though I have to say.
All the best
Andy
Guys, I can not stress this enough:
FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!
IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!
EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!
-Thom
Thank You for the advice Thom,
"FIREWALL OFF PORT 5060" how is that best done?
Br Stefan.
Quote from: tschak909 on December 01, 2014, 05:56:22 AM
Guys, I can not stress this enough:
FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!
IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!
EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!
-Thom
Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.
Quote from: Esperanto on December 03, 2014, 11:35:53 AM
Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.
Hmmm...I'd tend to agree with that.
All passwords used to be identical to the extension. That had been rectified a couple of years ago.
Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4 input tcp & udp 5060 DROP Edit Delete
that does not help.
I tried renaming /usr/sbin/asterisk and that also does not help.
Quote from: Esperanto on December 14, 2014, 09:20:09 PM
Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4 input tcp & udp 5060 DROP Edit Delete
that does not help.
I tried renaming /usr/sbin/asterisk and that also does not help.
anyone?
You could try to use 'netstat' and see where these connections are coming from.
If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.
-Anton
Quote from: Dap-P on December 23, 2014, 03:41:57 PM
You could try to use 'netstat' and see where these connections are coming from.
If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.
As intended by lmce I have the core as the router. As mentioned before, unplugging the internet cable stopped the ringing. I don't see anything special on netstat. what should I look for?