LinuxMCE suddenly rings

[totallymaxed]

That seems to stop the activity (see gap between 8:40 and 9:26) . How to prevent it without unplugging? 

Code: [Select]

2014-11-26 09:38:03 SIP 1006 Answer s ANSWERED 00:01
2014-11-26 09:32:24 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 09:31:18 SIP 100 Answer s ANSWERED 00:01
2014-11-26 09:27:13 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 09:26:15 SIP 1006 Answer s ANSWERED 00:00
2014-11-26 08:40:06 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:36:39 SIP 100 Congestion s ANSWERED 00:12
2014-11-26 08:35:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:30:26 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:28:39 SIP 6000 Answer s ANSWERED 00:00
2014-11-26 08:24:30 SIP 10001 Congestion s ANSWERED 00:13
2014-11-26 08:21:46 SIP 6000 Answer s ANSWERED 00:01
2014-11-26 08:17:25 SIP 1005 Answer s ANSWERED 00:01
2014-11-26 08:11:42 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 08:08:45 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 08:07:58 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 08:05:56 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:56:29 SIP 1003 Congestion s ANSWERED 00:13
2014-11-26 07:54:48 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:54:10 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:52:52 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:43:34 SIP 1005 Answer s ANSWERED 00:00
2014-11-26 07:40:43 SIP 100 Congestion s ANSWERED 00:13
2014-11-26 07:40:33 SIP 6001 Answer s ANSWERED 00:00
2014-11-26 07:33:44 SIP 1101 Congestion s ANSWERED 00:12
2014-11-26 07:32:07 SIP 5000 Answer s ANSWERED 00:00
2014-11-26 07:26:22 SIP 123456 Answer s ANSWERED 00:00
2014-11-26 07:20:56 SIP 5000 Answer s ANSWERED 00:01
2014-11-26 07:14:55 SIP 1101 Congestion s ANSWERED 00:13
2014-11-26 07:12:39 SIP 123456 Answer s ANSWERED 00:01

Well it looks like ladekribs who posted about his issue with Gigasets might have a solution for you...but it depends if your using Gigasets I guess. His issue does seem similar to your though I have to say.

All the best

Andy

[tschak909]

Guys, I can not stress this enough:

FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!

IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!

EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!

-Thom

[ladekribs]

Thank You for the advice Thom,

"FIREWALL OFF PORT 5060" how is that best done?

Br Stefan.

[Esperanto]

Guys, I can not stress this enough:

FOR THE LOVE OF ALL THAT IS HOLY, MAKE YOUR SIP EXTENSION PASSWORDS, STRONG! THERE IS A RASH OF SIP_VICIOUS RUNS HAPPENING WITH PHONE SPAMMERS LOOKING FOR FREE EXTENSIONS!

IF YOU PUT A PASSWORD like '12345' ON ONE OF YOUR SIP EXTENSIONS, IT'S YOUR OWN FUCKING FAULT, FOR WHAT HAPPENS! FIX IT!

EVEN BETTER? FIREWALL OFF PORT 5060, IF YOUR REGISTRAR CAN HANDLE REGISTRATIONS WITHOUT REQUIRING THE PORT TO BE OPEN!

-Thom

Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.

[totallymaxed]

Since the sip was not working I was not using the system and therefore had just a default install without any password modification. The passwords I noticed on the phone devices page are all something like: "ng1jaa7m4ccyaomc". So if that is an issue then I think a default install might be unsave.

Hmmm...I'd tend to agree with that.

[Marie.O]

All passwords used to be identical to the extension. That had been rectified a couple of years ago.

[Esperanto]

Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4    input            tcp & udp      5060          DROP      Edit Delete

that does not help.

I tried renaming /usr/sbin/asterisk and that also does not help.

[Esperanto]

Anybody a suggestion on how to stop this except pulling the wan plug? I tried adding a firewall rule to the input list:
ipv4    input            tcp & udp      5060          DROP      Edit Delete

that does not help.

I tried renaming /usr/sbin/asterisk and that also does not help.

anyone?

[Dap-P]

You could try to use 'netstat' and see where these connections are coming from.

If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.


-Anton

[Esperanto]

You could try to use 'netstat' and see where these connections are coming from.

If you dont have port 5060 forwarded, and you have a firewall rule, it must from somewhere in your internal lan, or from the core itself.

As intended by lmce I have the core as the router. As mentioned before, unplugging the internet cable stopped the ringing. I don't see anything special on netstat. what should I look for?