Bouncing Ghost Calls

[that1guy]

Greetings,

One of my clients is having an issue where one of there extensions will ring, user answers the call but no one is there. Immediately after answering, the call is terminated then another extension will ring. User answers, but no one is there. Again, as soon as the call is answered it is terminated then a different extension will ring. The cycle continues until every extension rings. This will happen at random once every few days. I have yet to find a pattern. During the call, there is no caller id. Checking call history, there are no entries for the "ghost" call.

We are using v15.5.

Anyone else have a similar issue?

 

[YiannisH_3CX]

Hello @that1guy

Is this a cloud PBX or local? How are the phones provisioned? What phones is the client using? Does this happen with specific phones or is random?

 

[that1guy]

Hello @that1guy

Is this a cloud PBX or local? How are the phones provisioned? What phones is the client using? Does this happen with specific phones or is random?

This is a cloud PBX. The phones are provisioned via SBC. We are using Yealink T41P phones, firmware version 36.83.0.20. Seems to be random. When it happens, the call will bounce to all extensions. This has happened at least 3 times now and each time the call originates from (rings to) a different extension. In each instance, the call would be answered, terminate, then ring another extension.

 

[leejor]

Is there any 3CX Activity Log associated with these calls?

 

[that1guy]

Is there any 3CX Activity Log associated with these calls?

I was going to run a capture, but the issue is unpredictable.

See attached from log.

 

[leejor]

You've blacked out a lot, so it's difficult to tell where the calls originate , other than (perhaps?) trunk 10001.
Do they all come from that trunk group? Do they look to originate from your provider? Could they be direct SIP calls?

Are they legitimate calls, does someone call back later saying they were trying to get through?

Did this just start, out of the blue? Any changes made to anything about the time they began?

 

[YiannisH_3CX]

If calls do originate from the provider you should contact the provider and ask why you receive these calls. They should be able to help you deal with these calls

 

[that1guy]

I know I blacked out a lot. Client requested IP's and FQDN be omitted from the screenshot.

They all come from that trunk group. I'm not certain that they calls are originating from the provider, but I will contact the provider to be safe.

These are not legitimate calls. No one calls back, at least.

Just started out of the blue. No changes had been made when the calls started.

I updated firmware to version 36.83.0.20 after these calls were reported to me. We've been running the updated firmware for a day and no reports of these calls.

Thank you for all the suggestions.

 

[leejor]

I would consider engaging your provider for assistance if these start up again. They may have information on where they originate, and may be able to block them. They may also know of other of their customers having the same issue, which would "encourage" them to find a way to end them.