T20P Incoming Call From Fake Extension

[wiwebtech]

Firmware Version: 9.72.0.80
Hardware Version: 7.0.1.62

Dedicated IP assigned by the router. Phone is attached to Grandstream UCM6102. Everything works fine as far as incoming and outgoing calls. There are 6 extensions, namely 101,102,103,104,105,106.

Lately, we have been receiving incoming calls from extension 1000 and 1001. Calls ALWAYS ring on extension 103. I understand that this happening because of port scanning by unknown "evil doers". How do we stop this from happening. We setup the whole system ourselves.

I have attached the Pcap file of this event, when T20P at extension 103 is ringing and shows 1000 or 1001 as incoming caller id.

[CWR]

Do you see this traffic in the UCM Logs? Or only on the phone?
If only on the phone you can turn off SIP Calls and that may help.

[wiwebtech]

(01-10-2015 04:49 AM)craigreilly Wrote:  Do you see this traffic in the UCM Logs? Or only on the phone?
If only on the phone you can turn off SIP Calls and that may help.

Thank you for taking the time to help me.

There is no entry in UCM log for any of these incoming calls.

I have looked around in T20 web interface but can't find any setting to turn off SIP Calls. Under features -> general information, Allow IP Calls is already disabled. Is this the SIP setting you are talking about?

[James_Yealink]

Hi,

You can set phone to only accpet calls from your sip server through autoprovision:

Parameter:
account.1.sip_trust_ctrl = 1

Or you can upgrade phone to V73 and enable this option under Account-> Advanced interface.

Regards,
James

[wiwebtech]

(01-10-2015 07:23 PM)Yealink_James Wrote:  Hi,

You can set phone to only accpet calls from your sip server through autoprovision:

Parameter:
account.1.sip_trust_ctrl = 1

Or you can upgrade phone to V73 and enable this option under Account-> Advanced interface.

Regards,
James

I have upgraded to V73 and enabled the option. It appears to be working. Thank you very much for your time and assistance. I highly appreciate it.