[YMCS/YDMP Free Trial Program]Yealink would like to offer Free Trial Program of Yealink device management service for our current eligible customers. You can see the details below.
https://www.yealink.com/ydmp-freetrial-2020

Yealink Forums » IP Phone Series » General topics v » Ghost Calls from Port Scanning

Post Reply 
 
Thread Rating:
  • 0 Votes - 0 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Ghost Calls from Port Scanning
Author Message
ctiefel Offline
Junior Member
**

Posts: 24
Joined: Nov 2013
Reputation: 0
Post: #1
Ghost Calls from Port Scanning
We have large deployments of Yealink T20 phones where individual phones are running off of individual home networks. Lately we have been seeing a large increase of what we are calling "ghost calls". This seems to be the end result of hackers port scanning known VOIP ports. The caller ID will say "100" or "1000" and ring the phone constantly, usually at night, and when they pick it up there is no one there.

Is there a way in the Yealink phone, older firmware or newer firmware, to restrict incoming calls to only those coming from the SIP server?
11-08-2013 10:01 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
Yealink Support Offline
Administrator
*******

Posts: 2,683
Joined: Dec 2012
Reputation: 25
Post: #2
RE: Ghost Calls from Port Scanning
Hi ctiefel,

You can try to add below syntaxs to your cfg template(M7 template) and auto-provisioning it.

1. You can try this syntax in CFG template.
---------------------------------------------------------------------------
#!version:1.0.0.1

#The x of the parameter "account.x.sip_trust_ctrl " ranges from 1 to max accounts. For example, x ranges from 1 to 6 of T28.

account.x.sip_trust_ctrl=1
------------------------------------------------------------------------------------------

When you want to enable this sip trust control for account 1, fill 1 to “account.1.sip_trust_ctrl”.
Then SIP messages from other servers will refuse by the phone.

2. If not, you can disable the “Allow IP Call” in webpage or auto-provisioning and try again.

-------------------------------------------------------------------------------------------------
#!version:1.0.0.1

#Enable or disable the phone to dial the IP address directly; 0-Disabled, 1-Enabled (default);
features.direct_ip_call_enable = 0

-------------------------------------------------------------------------------------------------

Please try again and feed back to me.
11-09-2013 12:03 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
gykovacs Offline
Junior Member
**

Posts: 3
Joined: Mar 2014
Reputation: 0
Post: #3
RE: Ghost Calls from Port Scanning
Hi support,

I have just faced with the same problem, port scanner rings my phones. I have tried the suggested solutions, but this disable the registration to my SIP server too.

T22P phone with FW 7.72.0.25

account.1.sip_trust_ctrl=1
account.2.sip_trust_ctrl=1
account.3.sip_trust_ctrl=1

Direct IP calls need for click2dial application so I can't disable.

Here are my logs (note: valid IP addresses and domain names were replaced because of security purpose)

> Apr 24 17:44:12 SIP [450]: SUA <5+notice> [000] DNS query:Found in Cache
> Apr 24 17:44:12 SIP [450]: DNS <6+info > [DNS] dns record 0: removed.example.com/111.222.333.444
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] DNS resolution with 111.222.333.444:5060
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Message sent: (to dest=111.222.333.444:5060)
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] REGISTER sip:removed.example.com SIP/2.0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209" <sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209" <sip:209@removed.example.com>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Contact: <sip:209@10.6.118.22:5072>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Max-Forwards: 70^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Expires: 3600^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <5+notice> [000] send request retransmission (id=1)^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Received message:
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] SIP/2.0 401 Unauthorized^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813;received=222.333.444.555;rport=5072^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209"<sip:209@removed.example.com>;tag=fdfa5237^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209"<sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] WWW-Authenticate: Digest realm="example",algorithm=MD5,nonce="53594d543bc71f60f7d560d4b656e40f3176ab17",qop="auth",opaque="",stale=false^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SUA <6+info > [000] SIPTrustCtrl IS Enable
> Apr 24 17:44:12 SIP [450]: SUA <3+error > [000] IP:[111.222.333.444] is NO found in the dns cache,discard this message!

The phone knows the IP address of the server, sends out the registration message, but after a little bit later the same IP address is not trusted already.
"IP:[111.222.333.444] is NO found in the dns cache,discard this message".
The registration is based on SRV records, the SRV contains 2 IP addresses with priority. In the logs I see only one IP address (the one with highest priority) if it counts.
Any advice?
04-25-2014 08:09 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
ctiefel Offline
Junior Member
**

Posts: 24
Joined: Nov 2013
Reputation: 0
Post: #4
RE: Ghost Calls from Port Scanning
(04-25-2014 08:09 PM)gykovacs Wrote:  Hi support,

I have just faced with the same problem, port scanner rings my phones. I have tried the suggested solutions, but this disable the registration to my SIP server too.

T22P phone with FW 7.72.0.25

account.1.sip_trust_ctrl=1
account.2.sip_trust_ctrl=1
account.3.sip_trust_ctrl=1

Direct IP calls need for click2dial application so I can't disable.

Here are my logs (note: valid IP addresses and domain names were replaced because of security purpose)

> Apr 24 17:44:12 SIP [450]: SUA <5+notice> [000] DNS query:Found in Cache
> Apr 24 17:44:12 SIP [450]: DNS <6+info > [DNS] dns record 0: removed.example.com/111.222.333.444
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] DNS resolution with 111.222.333.444:5060
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Message sent: (to dest=111.222.333.444:5060)
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] REGISTER sip:removed.example.com SIP/2.0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209" <sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209" <sip:209@removed.example.com>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Contact: <sip:209@10.6.118.22:5072>^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Max-Forwards: 70^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Expires: 3600^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <5+notice> [000] send request retransmission (id=1)^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Received message:
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] SIP/2.0 401 Unauthorized^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Via: SIP/2.0/UDP 10.6.118.22:5072;branch=z9hG4bK1557744813;received=222.333.444.555;rport=5072^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] To: "209"<sip:209@removed.example.com>;tag=fdfa5237^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] From: "209"<sip:209@removed.example.com>;tag=1736150681^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Call-ID: 579639055@10.6.118.22^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] CSeq: 1 REGISTER^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] WWW-Authenticate: Digest realm="example",algorithm=MD5,nonce="53594d543bc71f60f7d560d4b656e40f3176ab17",qop="auth",opaque="",stale=false^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] Content-Length: 0^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000] ^M
> Apr 24 17:44:12 SIP [450]: SDL <6+info > [000]
> Apr 24 17:44:12 SIP [450]: SUA <6+info > [000] SIPTrustCtrl IS Enable
> Apr 24 17:44:12 SIP [450]: SUA <3+error > [000] IP:[111.222.333.444] is NO found in the dns cache,discard this message!

The phone knows the IP address of the server, sends out the registration message, but after a little bit later the same IP address is not trusted already.
"IP:[111.222.333.444] is NO found in the dns cache,discard this message".
The registration is based on SRV records, the SRV contains 2 IP addresses with priority. In the logs I see only one IP address (the one with highest priority) if it counts.
Any advice?

The newer firmware has an option in the General Settings called "Allow IP Call". Have you tried setting this to "Disabled"?
04-25-2014 08:12 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
Yealink Support Offline
Administrator
*******

Posts: 2,683
Joined: Dec 2012
Reputation: 25
Post: #5
RE: Ghost Calls from Port Scanning
Hi gykovacs,

1. You can enable "Enable Outbound Proxy Server" and fill your server which can limit the calls from other servers by conguring your server settings.
2. You can try to disable "Allow IP Call". As i known, click2dial isn't releate to allow ip call feature.
(This post was last modified: 04-25-2014 08:33 PM by Yealink Support.)
04-25-2014 08:32 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
gykovacs Offline
Junior Member
**

Posts: 3
Joined: Mar 2014
Reputation: 0
Post: #6
RE: Ghost Calls from Port Scanning
Meanwhile I have tried:

account.1.static_cache_pri = 1
account.1.dns_cache_type = 2
account.1.sip_trust_ctrl = 1

but unfortunately it can't help.
1.

account.1.outbound_proxy_enable = 1
sip.use_out_bound_in_dialog = 0 #MUST HAVE to fix failover

2. I'm testing my phones with sipp, "Allow IP Call" is "Disabled", the phone rings

Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] INVITE sip:101@10.6.118.22:5070 SIP/2.0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Contact: 101:101@127.0.0.1:5060^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Max-Forwards: 70^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Subject: Performance Test^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Type: application/sdp^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 129^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] v=0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] o=user1 53655765 2353687637 IN IP4 127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] s=-^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] c=IN IP4 127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] t=0 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] m=audio 6000 RTP/AVP 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] a=rtpmap:0 PCMU/8000^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <5+notice> [000] Message received from: 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] This is a request
Apr 25 12:49:15 SIP [538]: SUA <5+notice> [000] generate Call ID (101)
Apr 25 12:49:15 SIP [538]: SDL <5+notice> [000] *** Call id set to 101 ***
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] DNS resolution with 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Message sent: (to dest=10.6.118.24:5060)
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] SIP/2.0 100 Trying^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] Emb event:[0x00000005] recv
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] replace header null
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] new incoming call:101
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info auto-answer= video=0 referred_by=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info answer-mode=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] user info ringtone= ringtone_ext_flag= ringtone_info= ringtone_url=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] diversion display_name= user_name= server_name=
Apr 25 12:49:15 SIP [447]: SUA <5+notice> [000] Message sent: [(PHONE_MSG_CALL_INCOME) -- (0xa000d) wParam(0x65)-lParam(0x0)]
Apr 25 12:49:15 Log [504]: TALK<6+info > [MSG:SIP==>Talklogic] message=[PHONE_MSG_CALL_INCOME][a000d] wParam=[101] lParam=[0]
Apr 25 12:49:15 Log [504]: FWDD<4+warnin> DND is forbidden !
Apr 25 12:49:15 Log [504]: TALK<6+info > CSessionManager::AddSession Add pSession [ID:1]
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_SwitchChannel eMode=0
Apr 25 12:49:15 Log [504]: VOIC<6+info > OpenHandfree eChannel=4
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetHandfreeStatus = 1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[7000d] to VPM[1][0]!
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=5
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70014] to VPM[1][18]!
Apr 25 12:49:15 Log [504]: CUIT<6+info > Set Power Light Status to [5]
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.683.730:OPEN_HANDFREE_MODE:00000001 00000000
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] smic param err
Apr 25 12:49:15 SIP [447]: SUA <6+info > [000] call status change 0 to 3
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] DNS resolution with 10.6.118.24:5060
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Message sent: (to dest=10.6.118.24:5060)
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] SIP/2.0 180 Ringing^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Via: SIP/2.0/UDP 127.0.0.1:5060;branch=z9hG4bK-7200-1-0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] From: 101 <sip:101@127.0.0.1:5060>;tag=1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] To: 8933 <sip:101@10.6.118.22:5070>;tag=889307918^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Call-ID: 1-7200@127.0.0.1^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] CSeq: 1 INVITE^M
Apr 25 12:49:15 Log [504]: TALK<6+info > New Incoming Call in line(0), Ringing.
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_SwitchChannel eMode=2
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetHandfreeStatus = 0
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70014] to VPM[1][18]!
Apr 25 12:49:15 Log [504]: DIR <6+info > After locate ring, the path is:
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Contact: <sip:101@10.6.118.22:5070>^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] User-Agent: Yealink SIP-T22P 7.72.0.25^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Allow-Events: talk,hold,conference,refer,check-sync^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] Content-Length: 0^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000] ^M
Apr 25 12:49:15 SIP [538]: SDL <6+info > [000]
Apr 25 12:49:15 Log [305]: SCRN<6+info > SCREEN_MSG_LIGHT_STATUS_CHANGE[0xffffff][0x1]
Apr 25 12:49:15 Log [305]: SCRN<6+info > Open back light Time[16777215] Level[2].
Apr 25 12:49:15 Log [504]: CUIT<6+info > Set Power Light Status to [8]
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.782.215:SET_VOLUNE:00000001 00000012
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.785.403:SET_VOLUNE:00000001 00000012
Apr 25 12:49:15 Log [504]: TALK<6+info > CRingingRoutine::PlayRing: /yealink/resource/Waves/Ring1.wav
Apr 25 12:49:15 Log [504]: VOIC<6+info > voice_PlayRingFromFilePath lpszRingPath=/yealink/resource/Waves/Ring1.wav
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetMute iCallID=-1 bMute=1
Apr 25 12:49:15 Log [504]: VOIC<6+info > PostMSGToVPM: Post Msg[70002] to VPM[-1][1]!
Apr 25 12:49:15 Log [504]: VOIC<6+info > CVoiceManager::PlayRing: strRingFile=[/yealink/resource/Waves/Ring1.wav]
Apr 25 12:49:15 Log [504]: VOIC<6+info > SetVolume iVolume=8 eType=1
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.848.015:TALK_MUTE:ffffffff 00000001
Apr 25 12:49:15 IPP[413]: IPP <5+notice>155.853.381:PLAY_FILE:00000001 00000001
(This post was last modified: 04-25-2014 08:54 PM by gykovacs.)
04-25-2014 08:34 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
Yealink Support Offline
Administrator
*******

Posts: 2,683
Joined: Dec 2012
Reputation: 25
Post: #7
RE: Ghost Calls from Port Scanning
Hi gykovacs,

Please ask your distributor for help and they can push to release a new firmware for you .
05-12-2014 11:28 AM
Find all posts by this user    like0    dislike0 Quote this message in a reply
gykovacs Offline
Junior Member
**

Posts: 3
Joined: Mar 2014
Reputation: 0
Post: #8
RE: Ghost Calls from Port Scanning
I have asked help from the local distributor before my forum post, no reply in the last month from them Sad

(05-12-2014 11:28 AM)Yealink Support Wrote:  Hi gykovacs,

Please ask your distributor for help and they can push to release a new firmware for you .
05-25-2014 08:02 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
Yealink Support Offline
Administrator
*******

Posts: 2,683
Joined: Dec 2012
Reputation: 25
Post: #9
RE: Ghost Calls from Port Scanning
Sorry for the late reply. In order to do more troubleshootings, please supply syslog level 6, config.bin and pcap and send to support@yealink.com.

How to Get the Correct Syslog, Config.bin and Trace
(This post was last modified: 05-29-2014 06:05 PM by Yealink Support.)
05-26-2014 05:55 PM
Find all posts by this user    like0    dislike0 Quote this message in a reply
remstar Offline
Junior Member
**

Posts: 1
Joined: Jun 2014
Reputation: 0
Post: #10
RE: Ghost Calls from Port Scanning
I have a client facing the same problem calls from 1000 NON stop 24x7 , There phones are connected to a hosted Elastix system, They are using a BT Homehub, However its only 1 phone that is being affected.

I've Disabled "allow i.p calls"

and changed the "Local SIP Port" under advanced to something random.

Is there anything else i can do to prevent this?, Can anything else be entered on the phone to prevent these calls? Apart from changing the sip port from 5060.

Or can something be changed on Elastix?

Would buying a a decent router help?

Cheers
06-30-2014 03:11 AM
Find all posts by this user    like0    dislike0 Quote this message in a reply
Post Reply 


Possibly Related Threads...
Thread: Author Replies: Views: Last Post
  Yealink T58W and Grandstream UCM6308 delayed audio on outgoing calls waltersjo 2 1,858 12-19-2023 11:10 PM
Last Post: waltersjo
  T33G - Unknown Symbol - Can't Make Outbound Calls bbopp 0 672 12-09-2023 03:21 AM
Last Post: bbopp
  WH67 (UC) Not Working for Outbound Calls Chepino96 0 925 10-04-2023 05:26 AM
Last Post: Chepino96
  View call logs for dropped calls computersense 0 996 08-15-2023 11:26 AM
Last Post: computersense
  Issue with headsets, calls are spontaneously ended sanderv85 3 2,471 06-15-2023 06:44 PM
Last Post: complex1
  W78P wont receive calls dleather 1 1,867 12-22-2022 12:15 AM
Last Post: dleather
  From field user part incomplete on some outbound calls oliv 1 1,983 11-25-2022 06:14 PM
Last Post: oliv
  Share Wi/Fi to PC port kevins1701 2 6,048 08-12-2022 01:33 AM
Last Post: seraphim19
  W80 Emergency Calls with Locked Keypad sandro84 0 2,983 10-18-2021 07:57 PM
Last Post: sandro84
  Silencing / Rejecting Queue Calls asafayan 1 4,742 07-13-2021 03:45 AM
Last Post: complex1

Forum Jump:


User(s) browsing this thread: 1 Guest(s)

Contact Us   Yealink   Return to Top   Return to Content   Lite (Archive) Mode   RSS Syndication