+- Yealink Forums (http://forum.yealink.com/forum)
+-- Forum: IP Phone Series (/forumdisplay.php?fid=4)
+--- Forum: General topics (/forumdisplay.php?fid=15)
+--- Thread: Ghost Calls from Port Scanning (/showthread.php?tid=1012)
Ghost Calls from Port Scanning - ctiefel - 11-08-2013 10:01 PM
We have large deployments of Yealink T20 phones where individual phones are running off of individual home networks. Lately we have been seeing a large increase of what we are calling "ghost calls". This seems to be the end result of hackers port scanning known VOIP ports. The caller ID will say "100" or "1000" and ring the phone constantly, usually at night, and when they pick it up there is no one there.
Is there a way in the Yealink phone, older firmware or newer firmware, to restrict incoming calls to only those coming from the SIP server?
RE: Ghost Calls from Port Scanning - Yealink Support - 11-09-2013 12:03 PM
Hi ctiefel,
You can try to add below syntaxs to your cfg template(M7 template) and auto-provisioning it.
1. You can try this syntax in CFG template.
---------------------------------------------------------------------------
#!version:1.0.0.1
#The x of the parameter "account.x.sip_trust_ctrl " ranges from 1 to max accounts. For example, x ranges from 1 to 6 of T28.
account.x.sip_trust_ctrl=1
------------------------------------------------------------------------------------------
When you want to enable this sip trust control for account 1, fill 1 to “account.1.sip_trust_ctrl”.
Then SIP messages from other servers will refuse by the phone.
2. If not, you can disable the “Allow IP Call” in webpage or auto-provisioning and try again.
-------------------------------------------------------------------------------------------------
#!version:1.0.0.1
#Enable or disable the phone to dial the IP address directly; 0-Disabled, 1-Enabled (default);
features.direct_ip_call_enable = 0
-------------------------------------------------------------------------------------------------
Please try again and feed back to me.
RE: Ghost Calls from Port Scanning - gykovacs - 04-25-2014 08:09 PM
Hi support,
I have just faced with the same problem, port scanner rings my phones. I have tried the suggested solutions, but this disable the registration to my SIP server too.
T22P phone with FW 7.72.0.25
account.1.sip_trust_ctrl=1
account.2.sip_trust_ctrl=1
account.3.sip_trust_ctrl=1
Direct IP calls need for click2dial application so I can't disable.
Here are my logs (note: valid IP addresses and domain names were replaced because of security purpose)
> Apr 24 17:44:12 SIP [450]: SUA <5+notice> [000] DNS query:Found in Cache
> Apr 24 17:44:12 SIP [450]: DNS <6+info > [DNS] dns record 0: removed.example.com/111.222.333.444
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] DNS resolution with 111.222.333.444:5060
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Message sent: (to dest=111.222.333.444:5060)
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] REGISTER sip:removed.example.com SIP/2.0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209" <sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209" <sip:209@removed.example.com>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Contact: <sip:209@10.6.118.22:5072>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Max-Forwards: 70^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Expires: 3600^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <5+notice> [000] send request retransmission (id=1)^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Received message:
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] SIP/2.0 401 Unauthorized^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813;received=222.333.444.555;rport=5072^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209"<sip:209@removed.example.com>;tag=fdfa5237^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209"<sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] WWW-Authenticate: Digest realm="example",algorithm=MD5,nonce="53594d543bc71f60f7d560d4b656e40f3176ab17",qop="auth",opaque="",stale=false^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SUA <6+info > [000] SIPTrustCtrl IS Enable
> Apr 24 17:44:12 SIP [450]: SUA <3+error > [000] IP:[111.222.333.444] is NO found in the dns cache,discard this message!
The phone knows the IP address of the server, sends out the registration message, but after a little bit later the same IP address is not trusted already.
"IP:[111.222.333.444] is NO found in the dns cache,discard this message".
The registration is based on SRV records, the SRV contains 2 IP addresses with priority. In the logs I see only one IP address (the one with highest priority) if it counts.
Any advice?
RE: Ghost Calls from Port Scanning - ctiefel - 04-25-2014 08:12 PM
(04-25-2014 08:09 PM)gykovacs Wrote: Hi support,
I have just faced with the same problem, port scanner rings my phones. I have tried the suggested solutions, but this disable the registration to my SIP server too.
T22P phone with FW 7.72.0.25
account.1.sip_trust_ctrl=1
account.2.sip_trust_ctrl=1
account.3.sip_trust_ctrl=1
Direct IP calls need for click2dial application so I can't disable.
Here are my logs (note: valid IP addresses and domain names were replaced because of security purpose)
> Apr 24 17:44:12 SIP [450]: SUA <5+notice> [000] DNS query:Found in Cache
> Apr 24 17:44:12 SIP [450]: DNS <6+info > [DNS] dns record 0: removed.example.com/111.222.333.444
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] DNS resolution with 111.222.333.444:5060
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Message sent: (to dest=111.222.333.444:5060)
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] REGISTER sip:removed.example.com SIP/2.0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209" <sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209" <sip:209@removed.example.com>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Contact: <sip:209@10.6.118.22:5072>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Max-Forwards: 70^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Expires: 3600^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <5+notice> [000] send request retransmission (id=1)^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Received message:
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] SIP/2.0 401 Unauthorized^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813;received=222.333.444.555;rport=5072^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209"<sip:209@removed.example.com>;tag=fdfa5237^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209"<sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] WWW-Authenticate: Digest realm="example",algorithm=MD5,nonce="53594d543bc71f60f7d560d4b656e40f3176ab17",qop="auth",opaque="",stale=false^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SUA <6+info > [000] SIPTrustCtrl IS Enable
> Apr 24 17:44:12 SIP [450]: SUA <3+error > [000] IP:[111.222.333.444] is NO found in the dns cache,discard this message!
The phone knows the IP address of the server, sends out the registration message, but after a little bit later the same IP address is not trusted already.
"IP:[111.222.333.444] is NO found in the dns cache,discard this message".
The registration is based on SRV records, the SRV contains 2 IP addresses with priority. In the logs I see only one IP address (the one with highest priority) if it counts.
Any advice?
The newer firmware has an option in the General Settings called "Allow IP Call". Have you tried setting this to "Disabled"?
RE: Ghost Calls from Port Scanning - Yealink Support - 04-25-2014 08:32 PM
Hi gykovacs,
1. You can enable "Enable Outbound Proxy Server" and fill your server which can limit the calls from other servers by conguring your server settings.
2. You can try to disable "Allow IP Call". As i known, click2dial isn't releate to allow ip call feature.
RE: Ghost Calls from Port Scanning - gykovacs - 04-25-2014 08:34 PM
Meanwhile I have tried:
account.1.static_cache_pri = 1
account.1.dns_cache_type = 2
account.1.sip_trust_ctrl = 1
but unfortunately it can't help.
1.
account.1.outbound_proxy_enable = 1
sip.use_out_bound_in_dialog = 0 #MUST HAVE to fix failover
2. I'm testing my phones with sipp, "Allow IP Call" is "Disabled", the phone rings
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] INVITE sip:101@10.6.118.22:5070 SIP/2.0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Contact: 101:101@127.0.0.1:5060^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Max-Forwards: 70^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Subject: Performance Test^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Type: application/sdp^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 129^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] v=0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] o=user1 53655765 2353687637 IN IP4 127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] s=-^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] c=IN IP4 127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] t=0 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] m=audio 6000 RTP/AVP 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] a=rtpmap:0 PCMU/8000^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <5+notice> [000] Message received from: 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] This is a request
Apr 25 12:49:15 SIP [538]: SUA <5+notice> [000] generate Call ID (101)
Apr 25 12:49:15 SIP [538]: SDL <5+notice> [000] *** Call id set to 101 ***
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] DNS resolution with 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Message sent: (to dest=10.6.118.24:5060)
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] SIP/2.0 100 Trying^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] Emb event:[0x00000005] recv
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] replace header null
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] new incoming call:101
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info auto-answer= video=0 referred_by=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info answer-mode=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info ringtone= ringtone_ext_flag= ringtone_info= ringtone_url=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] diversion display_name= user_name= server_name=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] Message sent: [(PHONE_MSG_CALL_INCOME) -- (0xa000d) wParam(0x65)-lParam(0x0)]
Apr 25 12:49:15 Log [504]: TALK<6+info > [MSG:SIP==>Talklogic] message=[PHONE_MSG_CALL_INCOME][a000d] wParam=[101] lParam=[0]
Apr 25 12:49:15 Log [504]: FWDD<4+warnin> DND is forbidden !
Apr 25 12:49:15 Log [504]: TALK<6+info > CSessionManager::AddSession Add pSession [ID:1]
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_SwitchChannel eMode=0
Apr 25 12:49:15 Log [504]: VOIC<6+info > OpenHandfree eChannel=4
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetHandfreeStatus = 1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[7000d] to VPM[1][0]!
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=5
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70014] to VPM[1][18]!
Apr 25 12:49:15 Log [504]: CUIT<6+info > Set Power Light Status to [5]
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.683.730:OPEN_HANDFREE_MODE:00000001 00000000
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] smic param err
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] call status change 0 to 3
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] DNS resolution with 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Message sent: (to dest=10.6.118.24:5060)
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] SIP/2.0 180 Ringing^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>;tag=889307918^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 Log [504]: TALK<6+info > New Incoming Call in line(0), Ringing.
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_SwitchChannel eMode=2
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetHandfreeStatus = 0
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70014] to VPM[1][18]!
Apr 25 12:49:15 Log [504]: DIR <6+info > After locate ring, the path is:
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Contact: <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 Log [305]: SCRN<6+info > SCREEN_MSG_LIGHT_STATUS_CHANGE[0xffffff][0x1]
Apr 25 12:49:15 Log [305]: SCRN<6+info > Open back light Time[16777215] Level[2].
Apr 25 12:49:15 Log [504]: CUIT<6+info > Set Power Light Status to [8]
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.782.215:SET_VOLUNE:00000001 00000012
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.785.403:SET_VOLUNE:00000001 00000012
Apr 25 12:49:15 Log [504]: TALK<6+info > CRingingRoutine::PlayRing: /yealink/resource/Waves/Ring1.wav
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_PlayRingFromFilePath lpszRingPath=/yealink/resource/Waves/Ring1.wav
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetMute iCallID=-1 bMute=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70002] to VPM[-1][1]!
Apr 25 12:49:15 Log [504]: VOIC<6+info > CVoiceManager::PlayRing: strRingFile=[/yealink/resource/Waves/Ring1.wav]
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.848.015:TALK_MUTE:ffffffff 00000001
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.853.381:PLAY_FILE:00000001 00000001
RE: Ghost Calls from Port Scanning - Yealink Support - 05-12-2014 11:28 AM
Hi gykovacs,
Please ask your distributor for help and they can push to release a new firmware for you .
RE: Ghost Calls from Port Scanning - gykovacs - 05-25-2014 08:02 PM
I have asked help from the local distributor before my forum post, no reply in the last month from them
(05-12-2014 11:28 AM)Yealink Support Wrote: Hi gykovacs,
Please ask your distributor for help and they can push to release a new firmware for you .
RE: Ghost Calls from Port Scanning - Yealink Support - 05-26-2014 05:55 PM
Sorry for the late reply. In order to do more troubleshootings, please supply syslog level 6, config.bin and pcap and send to support@yealink.com.
How to Get the Correct Syslog, Config.bin and Trace
RE: Ghost Calls from Port Scanning - remstar - 06-30-2014 03:11 AM
I have a client facing the same problem calls from 1000 NON stop 24x7 , There phones are connected to a hosted Elastix system, They are using a BT Homehub, However its only 1 phone that is being affected.
I've Disabled "allow i.p calls"
and changed the "Local SIP Port" under advanced to something random.
Is there anything else i can do to prevent this?, Can anything else be entered on the phone to prevent these calls? Apart from changing the sip port from 5060.
Or can something be changed on Elastix?
Would buying a a decent router help?
Cheers