Hi,
We got the following issue in our PBX:
Extension 9931 called extension 4662 but the extension which picked up the call was 1529. After, user 4662 noticed the lost call and called back to extension 9931. The call was on November 22th,2022 at 11:55 CST.
I see the below in the call log. In bold are suspicious lines from the logs
22/11/2022 11:55:22 (9931) (4662) 00:10:54
22/11/2022 11:55:10 (4662) (9931) 00:00:01
In the activity log I see the below:
22/11/2022 11:55:16 - [CM503001]: Call(C:69): Incoming call from Extn:9931 to <sip:[email protected]:0>
username="1T88",realm="3CXPhoneSystem",nonce="414d5359637d0d0496:b0a9c609f5ada462190a0a1267ecd634",uri="sip:4662@compány.3cx.us;tag3cx=1276dedb-413c-4162-ac91-63b15b931909",response="9001e2377d4268822c889a1b7a7579a9",algorithm=MD5
Supported: replaces, 100rel, timer, norefersub
22/11/2022 11:55:10 - Leg L:63.4[Extn:9931] is terminated: Cause: BYE from local
Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone for Android 18.1.2.69] PBX contact: [sip:[email protected]:5060]
User-Agent: 3CXPhone for Android 18.1.2.69
Content-Length: 438
v=0
o=- 3878128514 3878128514 IN IP4 192.168.1.81
s=pjmedia
b=AS:117
t=0 0
a=X-nat:0
m=audio 10012 RTP/AVP 0 8 9 18 120 96
c=IN IP4 192.168.1.81
b=TIAS:96000
b=AS:117
a=rtcp:10013
a=sendrecv
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:9 G722/8000
a=rtpmap:18 G729/8000
a=rtpmap:120 opus/48000/2
a=fmtp:120 useinbandfec=1
a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-15
m=video 0 RTP/AVP 31
c=IN IP4 127.0.0.1
22/11/2022 11:55:10 - [CM505001]: Endpoint Extn:9931: Device info: Device Not Identified: User Agent not matched; This line is suspicious
22/11/2022 11:55:10 - Replacing Leg L:63.4[Extn:9931] This line is suspicious
PBX Information;
-3CX version: 18.0
-Server OS: Debian 10
-Hosting: Self-hosted on AWS
-IP phone information:
model: Grandstream GRP2615
firmware: 1.0.7.33
-Has the firewall checker passed? Yes
-Are custom Phone Templates being used: Yes
May someone help us to find the cause of the issue?
Regards,
We got the following issue in our PBX:
Extension 9931 called extension 4662 but the extension which picked up the call was 1529. After, user 4662 noticed the lost call and called back to extension 9931. The call was on November 22th,2022 at 11:55 CST.
I see the below in the call log. In bold are suspicious lines from the logs
22/11/2022 11:55:22 (9931) (4662) 00:10:54
22/11/2022 11:55:10 (4662) (9931) 00:00:01
In the activity log I see the below:
22/11/2022 11:55:16 - [CM503001]: Call(C:69): Incoming call from Extn:9931 to <sip:[email protected]:0>
username="1T88",realm="3CXPhoneSystem",nonce="414d5359637d0d0496:b0a9c609f5ada462190a0a1267ecd634",uri="sip:4662@compány.3cx.us;tag3cx=1276dedb-413c-4162-ac91-63b15b931909",response="9001e2377d4268822c889a1b7a7579a9",algorithm=MD5
Supported: replaces, 100rel, timer, norefersub
22/11/2022 11:55:10 - Leg L:63.4[Extn:9931] is terminated: Cause: BYE from local
Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone for Android 18.1.2.69] PBX contact: [sip:[email protected]:5060]
User-Agent: 3CXPhone for Android 18.1.2.69
Content-Length: 438
v=0
o=- 3878128514 3878128514 IN IP4 192.168.1.81
s=pjmedia
b=AS:117
t=0 0
a=X-nat:0
m=audio 10012 RTP/AVP 0 8 9 18 120 96
c=IN IP4 192.168.1.81
b=TIAS:96000
b=AS:117
a=rtcp:10013
a=sendrecv
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:9 G722/8000
a=rtpmap:18 G729/8000
a=rtpmap:120 opus/48000/2
a=fmtp:120 useinbandfec=1
a=rtpmap:96 telephone-event/8000
a=fmtp:96 0-15
m=video 0 RTP/AVP 31
c=IN IP4 127.0.0.1
22/11/2022 11:55:10 - [CM505001]: Endpoint Extn:9931: Device info: Device Not Identified: User Agent not matched; This line is suspicious
22/11/2022 11:55:10 - Replacing Leg L:63.4[Extn:9931] This line is suspicious
PBX Information;
-3CX version: 18.0
-Server OS: Debian 10
-Hosting: Self-hosted on AWS
-IP phone information:
model: Grandstream GRP2615
firmware: 1.0.7.33
-Has the firewall checker passed? Yes
-Are custom Phone Templates being used: Yes
May someone help us to find the cause of the issue?
Regards,
