News:

Rule #1 - Be Patient - Rule #2 - Don't ask when, if you don't contribute - Rule #3 - You have coding skills - LinuxMCE's small brother is available: http://www.agocontrol.com

Main Menu

LinuxMCE suddenly rings

Started by Esperanto, November 14, 2014, 07:23:20 AM

Previous topic - Next topic

Esperanto

LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?

2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00

Esperanto


totallymaxed

Quote from: Esperanto on November 14, 2014, 07:23:20 AM
LMCE suddenly started ringing. I have tons of unknown entries in the call log but non on the specific ring times. Any ideas what it might be and what might cause it? Also what are all those entries?

2014-11-14 07:03:44 SIP 5001 Answer s ANSWERED 00:00
2014-11-14 06:58:35 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:55:09 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:52:05 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:39 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:49:24 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:34:47 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:27:28 SIP 100 Answer s ANSWERED 00:00
2014-11-14 06:22:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:22:26 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 06:19:59 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 06:07:47 SIP 10001 Congestion s ANSWERED 00:13
2014-11-14 06:07:03 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:02 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:07:00 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:59 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:57 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:56 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:06:54 SIP 102030 Answer s ANSWERED 00:01
2014-11-14 06:06:53 SIP 102030 Answer s ANSWERED 00:00
2014-11-14 06:05:29 SIP 4001 Answer s ANSWERED 00:00
2014-11-14 05:59:44 SIP 100 Answer s ANSWERED 00:00
2014-11-14 05:53:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-14 05:51:59 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:58 SIP 2006 Answer s ANSWERED 00:01
2014-11-14 05:51:57 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:56 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:55 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:54 SIP 2006 Answer s ANSWERED 00:00
2014-11-14 05:51:53 SIP 2006 Answer s ANSWERED 00:00


Do you have an external trunk connected to a telecome provider? Can inbound external calls reach your system? It could be a auto-dialer from an external source. Another possibility is that you have accidentally created or triggered a 'rogue' telecom scenario or possibly created a scenario that accidentally calls the main call group every 10 mins.

Just some ideas....

All the best

Andy
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

ladekribs

Do you have an extension with a very simple password, that might have been hacked?

BR Stefan

Esperanto

whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.

Fortunately it seems to have stopped ringing after a few reboots.

I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom

2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01

totallymaxed

Quote from: Esperanto on November 21, 2014, 02:33:26 PM
whats the correct way to check that? I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.

Fortunately it seems to have stopped ringing after a few reboots.

I still get all these entries in the call detailed records log. Is that normal? I do/use nothing with telecom

2014-11-21 14:29:57 SIP 2055 Answer s ANSWERED 00:00
2014-11-21 14:25:41 SIP 1181 Answer s ANSWERED 00:01
2014-11-21 14:22:51 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 14:21:25 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:19:35 SIP 88108 Congestion s ANSWERED 00:13
2014-11-21 14:17:12 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:15:25 SIP 400 Answer s ANSWERED 00:01
2014-11-21 14:12:58 SIP 1181 Answer s ANSWERED 00:00
2014-11-21 14:08:49 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:06:33 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 14:04:41 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:24 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 14:00:19 SIP 400 Wait s ANSWERED 00:01
2014-11-21 13:57:08 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:56:08 SIP 9996 Answer s ANSWERED 00:00
2014-11-21 13:51:55 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:50:42 SIP 209 Answer s ANSWERED 00:01
2014-11-21 13:47:43 SIP 8001 Answer s ANSWERED 00:01
2014-11-21 13:45:24 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:43:32 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:39:22 SIP 8001 Answer s ANSWERED 00:00
2014-11-21 13:35:13 SIP 9999 Answer s ANSWERED 00:01
2014-11-21 13:35:08 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:31:07 SIP 106 Congestion s ANSWERED 00:13
2014-11-21 13:30:57 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:30:20 SIP 400 Answer s ANSWERED 00:01
2014-11-21 13:26:42 SIP 9509 Answer s ANSWERED 00:01
2014-11-21 13:22:31 SIP 9509 Answer s ANSWERED 00:00
2014-11-21 13:18:17 SIP 6303 Answer s ANSWERED 00:01
2014-11-21 13:15:01 SIP 1004 Wait s ANSWERED 00:01


A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen. If they do with the external trunk to your telecom provider disabled then you know that the cause is something internal to your system.

All the best

Andy
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

Esperanto

Quote from: totallymaxed on November 22, 2014, 12:36:14 PM
Quote from: Esperanto on November 21, 2014, 02:33:26 PM
I had only one SIP provider and since it did not work I was not using it. Even after disabling that account it was still doing the ringing.
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.
doesn't that previous message already answers that option?

totallymaxed

Quote from: Esperanto on November 24, 2014, 11:28:43 AM
A simple test would be to temporarily disable the external trunk and see if the phantom rings still happen.

doesn't that previous message already answers that option?

Actually it does...I hadn't noticed you mentioned disabling your provider. Glad the rings have stopped...and I hope they don't return! Does the log still show similar call activity now?

All the best

Andy
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

Esperanto

Quote from: totallymaxed on November 24, 2014, 02:11:58 PMDoes the log still show similar call activity now?

Actually it does. Any ideas what might cause it?

2014-11-24 17:00:42 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:54:42 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:46:34 SIP 1223 Answer s ANSWERED 00:01
2014-11-24 16:45:10 SIP 100 Congestion s ANSWERED 00:13
2014-11-24 16:38:16 SIP 123456 Answer s ANSWERED 00:00
2014-11-24 16:34:15 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:32:12 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:28:30 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:26:25 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:19:48 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:19:47 SIP 9000 Answer s ANSWERED 00:00
2014-11-24 16:18:42 SIP 27 Answer s ANSWERED 00:01
2014-11-24 16:17:49 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:14:12 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:14:11 SIP 8009 Answer s ANSWERED 00:00
2014-11-24 16:13:06 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 16:08:48 SIP 27 Answer s ANSWERED 00:00
2014-11-24 16:08:27 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:08:26 SIP 8008 Answer s ANSWERED 00:00
2014-11-24 16:04:03 SIP 106 Congestion s ANSWERED 00:13
2014-11-24 16:03:46 SIP 104 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 16:02:57 SIP 8007 Answer s ANSWERED 00:00
2014-11-24 15:59:01 SIP 102 Answer s ANSWERED 00:00
2014-11-24 15:57:14 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:57:13 SIP 8006 Answer s ANSWERED 00:00
2014-11-24 15:56:17 SIP 2001 Congestion s ANSWERED 00:13
2014-11-24 15:51:42 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:51:41 SIP 8005 Answer s ANSWERED 00:00
2014-11-24 15:49:10 SIP 102 Answer s ANSWERED 00:00

lemming86_au

Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.

Regards,
Josh

totallymaxed

Quote from: lemming86_au on November 25, 2014, 05:16:13 AM
Do you have port 5060 forwarded to the core?
If so, it is likely hackers trying to authenticate as an extension & make a call.
When that fails, the call is passed to the default inbound route, which makes your phones ring.

Regards,
Josh

Hmmm...well I don't think that can be it as he's disabled his telecom VOIP service provider. I guess they could be stupid hackers who can hack in but are too lazy to see if there's a working trunk/voip provider though!

...Esperanto why don't you run your Core for a period without a WAN side connection and see if the logs still indicate telecom activity?

All the best

Andy
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

lemming86_au

Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.

The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.

If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.

Regards,
Josh

totallymaxed

Quote from: lemming86_au on November 25, 2014, 10:50:12 AM
Actually that doesn't require a trunk to be configured, but it does require port 5060 to be forwarded to the core.

The hackers are hunting for externally accessible extensions with weak passwords, the call is just a result of a failed attempt & asterisk shunting the connection to the default incoming route. The number in the 3rd column of the log is likely the extension number they tried to connect as.

If there is no need for external SIP extensions, remove any port forwarding for port 5060, it shouldn't be required for trunk connections.

Regards,
Josh

Agreed re it not needing a configured trunk. That's why i suggested disabling his WAN side connection to see if the call traffic went away.

All the best

Andy
Andy Herron,
CHT Ltd

For Dianemo/LinuxMCE consulting advice;
@herron on Twitter, totallymaxed+inquiries@gmail.com via email or PM me here.

Get Dianemo-Rpi2 ARM Licenses [url="http://forum.linuxmce.org/index.php?topic=14026.0"]http://forum.linuxmce.org/index.php?topic=14026.0[/url]

Get RaspSqueeze-CEC or Raspbmc-CEC for Dianemo/LinuxMCE: [url="http://wp.me/P4KgIc-5P"]http://wp.me/P4KgIc-5P[/url]

Facebook: [url="https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465"]https://www.facebook.com/pages/Dianemo-Home-Automation/226019387454465[/url]

[url="http://www.dianemo.co.uk"]http://www.dianemo.co.uk[/url]

Esperanto

Quote from: totallymaxed on November 25, 2014, 11:18:28 AM
That's why i suggested disabling his WAN side connection to see if the call traffic went away.

That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging?  ;)

2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01

ladekribs

same thing happened to me as far as I can see.
I had an extension used by a Siemens gigaset phone with password "12345" when I changed that password, the ringing stopped. so if I not total misunderstood, asterisk is open for communication to the extensions if you know the password and ID.

BR Stefan