Constant Calls from 99 or 1000

[Matthew Main]

Hi guys

i am getting calls from 99 or 1000

nothing is showing on the server. and no ext on the domain that match

any ideas?

kind regards

Matt

 

[DigitalDaz]

They won't be coming through the PBX, probably hitting your router directly. Try switching to TCP, that will probably force your registration to a random high port.

 

[Matthew Main]

any ideas what is causing this, never had this issue before, never had to use tcp to stop it

 

[EasyBB]

Any port forwarding on the router or uPnP enabled?

Edit: Just saw DigitalDaz's post below so I believe your Fusion is on a public IP.

 

[DigitalDaz]

My guess is that it is highly likely using UDP that the port being displayed in the sip registrations page is at or around 5060, if so, its just hackers having a stab.

Depending on the phone you can mitigate it there, yealinks for example have a setting to only allow trust server, ie the one you are registered to.

This is very common, also, in general TCP just handles everything better anyway so that's usually the easiest method to deal with it..

 

[DigitalDaz]

You also want to either enable TCP on your DIDs now from Simwood or you are probably getting fragmented UDP packets inbound due to the new stack.

 

[Matthew Main]

i have tcp and udp for 5080

You also want to either enable TCP on your DIDs now from Simwood or you are probably getting fragmented UDP packets inbound due to the new stack.

already done

 

[Matthew Main]

can i message you in IRC DigiDaz

 

[DigitalDaz]

yep

 

[hailthemelody]

Hi @Matthew Main and @DigitalDaz

If it's appropriate (ie - doesn't compromise security), would you mind posting any solutions/troubleshooting steps that could be helpful to others? I'm seeming some of these requests hitting my PBX and want to ensure Fail2Ban is capturing them appropriately. Or maybe there's another solution etc.