Call jumping from phone to phone

[sbonner]

We have a number of phones set up in a single office with both a ring group "Main Number" and a queue. The system works, but every so often, a call will come in and register on the phones as "Main Number 310" or "Main Number 110" or possibly 410, 301, etc. (These are not extension numbers - I do not know where these numbers are coming from.) When someone goes to answer the call, it will immediatelly disconnect and jump to another phone somewhere in the office (not even necessarily within the ring group -- all phones in the office get hit). It will ring and ring and ring until someone answers it, and then it will jump to another phone, and so on and so on.

Edited to add: it will continue to do this until someone goes to every phone in the office and pick up. No actual call is ever received.

I have isolated this event to having occurred twice within a certain amount of time (shown in logs) but I don't know what may be the culprit. Is it the errors for "No RTP packets were received"?

Please provide any assistance that you can.

14:25:10.281  [CM503008]: Call(155): Call is terminated
14:24:49.375  Currently active calls - 1: [155]
14:24:49.234  [MS105000] C:154.1: No RTP packets were received:remoteAddr=192.168.1.3:5073,extAddr=71.170.105.211:9044,localAddr=71.170.105.211:9044
14:24:45.109  [MS105000] C:153.1: No RTP packets were received:remoteAddr=192.168.1.3:5075,extAddr=71.170.105.211:9042,localAddr=71.170.105.211:9042
14:24:17.375  Currently active calls - 1: [155]
14:24:09.281  [CM503007]: Call(155): Device joined: sip:[email protected]:5060
14:24:09.265  [CM503007]: Call(155): Device joined: sip:[email protected]:5062
14:24:09.250  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:24:09.250  [CM503002]: Call(155): Alerting sip:[email protected]:5060
14:24:02.453  [CM503025]: Call(155): Calling VoIPline:4696661580@(Ln.10000@Buz)@[Dev:sip:[email protected]:5060]
14:24:02.375  [CM503004]: Call(155): Route 1: VoIPline:4696661580@(Ln.10000@Buz)@[Dev:sip:[email protected]:5060]
14:24:02.375  [CM503010]: Making route(s) to <sip:[email protected]>
14:24:02.359  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:24:02.359  [CM503001]: Call(155): Incoming call from Ext.100 to <sip:[email protected]>
14:23:55.281  [CM503008]: Call(154): Call is terminated
14:23:55.265  [CM503021]: Call(154): ACK is not received
14:23:50.734  [CM503008]: Call(153): Call is terminated
14:23:50.718  [CM503021]: Call(153): ACK is not received
14:23:45.375  Currently active calls - 2: [153,154]
14:23:23.187  [CM503007]: Call(154): Device joined: sip:[email protected]:5062
14:23:23.171  [CM503007]: Call(154): Device joined: sip:[email protected]:5060
14:23:19.203  [CM503003]: Call(153): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:23:18.671  [CM503007]: Call(153): Device joined: sip:[email protected]:5062
14:23:18.656  [CM503007]: Call(153): Device joined: sip:[email protected]:5060
14:23:17.203  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:23:17.187  [CM503002]: Call(154): Alerting sip:[email protected]:5062
14:23:16.156  [CM503025]: Call(154): Calling RingAll800[Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:23:16.125  [CM503004]: Call(154): Route 1: RingAll800[Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:23:16.125  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:23:16.125  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:23:16.109  [CM503001]: Call(154): Incoming call from 401@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:23:16.046  [CM503012]: Inbound office hours rule (unnamed) for 10000 forwards to DN:500
14:23:13.687  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:23:13.687  [CM503002]: Call(153): Alerting sip:[email protected]:5062
14:23:13.687  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:23:13.671  [CM503002]: Call(153): Alerting sip:[email protected]:5062
14:23:13.375  Currently active calls - 1: [153]
14:23:12.937  [CM503025]: Call(153): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:23:12.921  [CM503025]: Call(153): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:23:12.906  [CM503004]: Call(153): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:23:12.890  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:23:12.890  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:23:12.875  [CM503001]: Call(153): Incoming call from 401@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:23:12.812  [CM503012]: Inbound office hours rule (unnamed) for 10000 forwards to DN:500
14:20:27.343  [CM503008]: Call(152): Call is terminated
14:20:01.375  Currently active calls - 1: [152]
14:19:29.375  Currently active calls - 1: [152]
14:18:57.375  Currently active calls - 1: [152]
14:18:45.921  [CM503003]: Call(152): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.115:5062
14:18:45.687  [CM503007]: Call(152): Device joined: sip:[email protected]:5062
14:18:45.671  [CM503007]: Call(152): Device joined: sip:[email protected]:5060
14:18:43.156  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:18:43.156  [CM503002]: Call(152): Alerting sip:[email protected]:5062
14:18:43.140  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:18:43.140  [CM503002]: Call(152): Alerting sip:[email protected]:5062
14:18:42.500  [CM503025]: Call(152): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:18:42.484  [CM503025]: Call(152): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:18:42.468  [CM503004]: Call(152): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:18:42.468  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:18:42.453  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:18:42.437  [CM503001]: Call(152): Incoming call from 12145146730@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:18:42.375  [CM503012]: Inbound any hours rule (unnamed) for 10000 forwards to DN:500
14:18:40.203  [CM503008]: Call(150): Call is terminated
14:18:25.375  Currently active calls - 1: [150]
14:17:53.375  Currently active calls - 1: [150]
14:17:21.375  Currently active calls - 1: [150]
14:16:49.375  Currently active calls - 1: [150]
14:16:20.765  [CM503008]: Call(151): Call is terminated
14:16:17.375  Currently active calls - 2: [150,151]
14:16:09.281  [MS211000] C:150.1: 66.128.56.214:24370 is delivering DTMF using RTP payload (RFC2833). In-Band DTMF tone detection is disabled for this call segment.
14:15:49.406  [CM503003]: Call(151): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:15:49.093  [CM503007]: Call(151): Device joined: sip:[email protected]:5062
14:15:49.093  [CM503007]: Call(151): Device joined: sip:[email protected]:5060
14:15:45.375  Currently active calls - 2: [150,151]
14:15:44.406  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:15:44.406  [CM503002]: Call(151): Alerting sip:[email protected]:5062
14:15:43.593  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:15:43.593  [CM503002]: Call(151): Alerting sip:[email protected]:5062
14:15:42.875  [CM503025]: Call(151): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:15:42.859  [CM503025]: Call(151): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:15:42.843  [CM503004]: Call(151): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:15:42.828  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:15:42.828  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:15:42.812  [CM503001]: Call(151): Incoming call from 19727863165@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:15:42.750  [CM503012]: Inbound any hours rule (unnamed) for 10000 forwards to DN:500
14:15:42.265  [CM503007]: Call(150): Device joined: sip:[email protected]:5062
14:15:38.390  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:15:38.390  [CM503002]: Call(150): Alerting sip:[email protected]:5062
14:15:37.609  [CM503025]: Call(150): Calling Ext:Ext.102@[Dev:sip:[email protected]:5062]
14:15:37.546  [CM503004]: Call(150): Route 1: Ext:Ext.102@[Dev:sip:[email protected]:5062]
14:15:37.546  [CM503010]: Making route(s) to <sip:[email protected]>
14:15:13.375  Currently active calls - 1: [150]
14:14:41.375  Currently active calls - 1: [150]
14:14:32.953  [CM503003]: Call(150): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:14:32.750  [CM503007]: Call(150): Device joined: sip:[email protected]:5062
14:14:32.750  [CM503007]: Call(150): Device joined: sip:[email protected]:5060
14:14:29.203  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:14:29.187  [CM503002]: Call(150): Alerting sip:[email protected]:5062
14:14:29.171  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:14:29.171  [CM503002]: Call(150): Alerting sip:[email protected]:5062
14:14:28.453  [CM503025]: Call(150): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:14:28.437  [CM503025]: Call(150): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:14:28.421  [CM503004]: Call(150): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:14:28.406  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:14:28.406  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:14:28.390  [CM503001]: Call(150): Incoming call from 12145146730@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:14:28.343  [CM503012]: Inbound any hours rule (unnamed) for 10000 forwards to DN:500
14:05:51.687  [MS105000] C:147.1: No RTP packets were received:remoteAddr=192.168.1.3:5073,extAddr=71.170.105.211:9034,localAddr=71.170.105.211:9034
14:05:51.687  [MS105000] C:146.1: No RTP packets were received:remoteAddr=192.168.1.3:5073,extAddr=71.170.105.211:9032,localAddr=71.170.105.211:9032
14:05:08.015  [CM503008]: Call(147): Call is terminated
14:05:08.000  [CM503021]: Call(147): ACK is not received
14:05:05.375  Currently active calls - 1: [147]
14:05:02.390  [CM503007]: Call(147): Device joined: sip:[email protected]:5062
14:05:02.375  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:05:02.359  [CM503002]: Call(147): Alerting sip:[email protected]:5062
14:05:02.343  [CM503008]: Call(149): Call is terminated
14:05:02.234  [CM503003]: Call(148): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.106:5062
14:05:02.156  [CM503025]: Call(147): Calling @[Dev:sip:[email protected]:5062]
14:05:02.125  [CM503008]: Call(148): Call is terminated
14:05:01.921  [CM503007]: Call(149): Device joined: sip:[email protected]:5062
14:05:01.906  [CM503007]: Call(149): Device joined: sip:[email protected]:5488
14:04:58.781  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:04:58.781  [CM503002]: Call(149): Alerting sip:[email protected]:5062
14:04:57.781  [CM503025]: Call(149): Calling Ext:Ext.100@[Dev:sip:[email protected]:5062]
14:04:57.750  [CM503004]: Call(149): Route 1: Ext:Ext.100@[Dev:sip:[email protected]:5062]
14:04:57.750  [CM503010]: Making route(s) to <sip:[email protected]:5060;nofwd=1;tag3cx=24-IBWXIGDRBJ>
14:04:57.734  [CM505001]: Ext.801: Device info: Device Identified: [Man: 3CX Ltd.;Mod: 3CX Queue;Rev: General] Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Queue Manager (q=801)] PBX contact: [sip:[email protected]:5060]
14:04:57.734  [CM503001]: Call(149): Incoming call from Ext.801 to <sip:[email protected]:5060;nofwd=1;tag3cx=24-IBWXIGDRBJ>
14:04:57.500  [CM503008]: Call(146): Call is terminated
14:04:57.484  [CM503021]: Call(146): ACK is not received
14:04:47.921  [CM503008]: Call(145): Call is terminated
14:04:37.296  [CM505001]: Ext.103: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:04:37.296  [CM503002]: Call(148): Alerting sip:[email protected]:5062
14:04:36.593  [CM503025]: Call(148): Calling Ext:Ext.103@[Dev:sip:[email protected]:5062]
14:04:36.546  [CM503004]: Call(148): Route 1: Ext:Ext.103@[Dev:sip:[email protected]:5062]
14:04:36.546  [CM503010]: Making route(s) to <sip:[email protected]:5060;nofwd=1;tag3cx=23-UXJGGXXWBK>
14:04:36.546  [CM505001]: Ext.801: Device info: Device Identified: [Man: 3CX Ltd.;Mod: 3CX Queue;Rev: General] Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Queue Manager (q=801)] PBX contact: [sip:[email protected]:5060]
14:04:36.531  [CM503001]: Call(148): Incoming call from Ext.801 to <sip:[email protected]:5060;nofwd=1;tag3cx=23-UXJGGXXWBK>
14:04:35.937  [CM503007]: Call(147): Device joined: sip:[email protected]:5488
14:04:35.921  [CM503007]: Call(147): Device joined: sip:[email protected]:5060
14:04:35.906  [CM505001]: Ext.801: Device info: Device Identified: [Man: 3CX Ltd.;Mod: 3CX Queue;Rev: General] Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CX Queue Manager (q=801)] PBX contact: [sip:[email protected]:5060]
14:04:35.906  [CM503002]: Call(147): Alerting sip:[email protected]:5488
14:04:35.828  [CM503003]: Call(147): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:04:35.781  [CM503025]: Call(147): Calling Ext:Ext.801@[Dev:sip:[email protected]:5488]
14:04:35.718  [CM503005]: Call(147): Forwarding: Ext:Ext.801@[Dev:sip:[email protected]:5488]
14:04:33.375  Currently active calls - 3: [145,146,147]
14:04:25.578  [CM503003]: Call(146): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:04:25.437  [CM503007]: Call(146): Device joined: sip:[email protected]:5062
14:04:25.437  [CM503007]: Call(146): Device joined: sip:[email protected]:5060
14:04:25.031  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:04:25.031  [CM503002]: Call(147): Alerting sip:[email protected]:5062
14:04:23.687  [CM503025]: Call(147): Calling RingAll800[Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:04:23.640  [CM503004]: Call(147): Route 1: RingAll800[Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:04:23.640  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:04:23.640  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:04:23.625  [CM503001]: Call(147): Incoming call from 330@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:04:23.578  [CM503012]: Inbound office hours rule (unnamed) for 10000 forwards to DN:500
14:04:21.921  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:04:21.921  [CM503002]: Call(146): Alerting sip:[email protected]:5062
14:04:21.125  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:04:21.109  [CM503002]: Call(146): Alerting sip:[email protected]:5062
14:04:20.421  [CM503025]: Call(146): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:04:20.421  [CM503025]: Call(146): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:04:20.375  [CM503004]: Call(146): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:04:20.375  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:04:20.359  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:04:20.359  [CM503001]: Call(146): Incoming call from 330@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:04:20.312  [CM503012]: Inbound office hours rule (unnamed) for 10000 forwards to DN:500
14:04:01.375  Currently active calls - 1: [145]
14:03:43.203  [CM503007]: Call(145): Device joined: sip:[email protected]:5062
14:03:40.750  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:03:40.750  [CM503002]: Call(145): Alerting sip:[email protected]:5062
14:03:40.078  [CM503025]: Call(145): Calling Ext:Ext.102@[Dev:sip:[email protected]:5062]
14:03:40.031  [CM503004]: Call(145): Route 1: Ext:Ext.102@[Dev:sip:[email protected]:5062]
14:03:40.015  [CM503010]: Making route(s) to <sip:[email protected]>
14:03:29.375  Currently active calls - 1: [145]
14:03:21.734  [CM503003]: Call(145): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:03:21.468  [CM503007]: Call(145): Device joined: sip:[email protected]:5062
14:03:21.453  [CM503007]: Call(145): Device joined: sip:[email protected]:5060
14:03:17.765  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:03:17.750  [CM503002]: Call(145): Alerting sip:[email protected]:5062
14:03:17.468  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:03:17.468  [CM503002]: Call(145): Alerting sip:[email protected]:5062
14:03:16.828  [CM503025]: Call(145): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:03:16.828  [CM503025]: Call(145): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:03:16.796  [CM503004]: Call(145): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:03:16.781  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:03:16.781  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:03:16.765  [CM503001]: Call(145): Incoming call from 19403683907@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:03:16.718  [CM503012]: Inbound any hours rule (unnamed) for 10000 forwards to DN:500
14:03:05.687  [CM503008]: Call(144): Call is terminated
14:02:57.375  Currently active calls - 1: [144]
14:02:25.375  Currently active calls - 1: [144]
14:02:05.000  [CM503003]: Call(144): Call to sip:[email protected] has failed; Cause: 487 Request Terminated; from IP:192.168.1.100:5062
14:02:04.687  [CM503007]: Call(144): Device joined: sip:[email protected]:5062
14:02:04.671  [CM503007]: Call(144): Device joined: sip:[email protected]:5060
14:02:00.781  [CM505001]: Ext.100: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:02:00.781  [CM503002]: Call(144): Alerting sip:[email protected]:5062
14:02:00.765  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:02:00.765  [CM503002]: Call(144): Alerting sip:[email protected]:5062
14:02:00.093  [CM503025]: Call(144): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:02:00.078  [CM503025]: Call(144): Calling RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062]
14:02:00.062  [CM503004]: Call(144): Route 1: RingAll800[Ext.100,Ext.102,Ext.125]@[Dev:sip:[email protected]:5062,Dev:sip:[email protected]:5062]
14:02:00.046  [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:02:00.046  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:02:00.031  [CM503001]: Call(144): Incoming call from 18175671646@(Ln.10000@Buz) to <sip:[email protected]:5060>
14:01:59.968  [CM503012]: Inbound any hours rule (unnamed) for 10000 forwards to DN:500
14:01:54.890  [CM503008]: Call(143): Call is terminated
14:01:53.375  Currently active calls - 1: [143]
14:01:21.375  Currently active calls - 1: [143]
14:01:20.796  [CM503007]: Call(143): Device joined: sip:[email protected]:5060
14:01:20.796  [CM503007]: Call(143): Device joined: sip:[email protected]:5062
14:01:20.781  [CM505003]: Provider:[Buz] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [sipcli/v1.8] PBX contact: [sip:[email protected]:5060]
14:01:20.781  [CM503002]: Call(143): Alerting sip:[email protected]:5060
14:00:55.015  [CM503025]: Call(143): Calling VoIPline:9403683907@(Ln.10000@Buz)@[Dev:sip:[email protected]:5060]
14:00:54.937  [CM503004]: Call(143): Route 1: VoIPline:9403683907@(Ln.10000@Buz)@[Dev:sip:[email protected]:5060]
14:00:54.937  [CM503010]: Making route(s) to <sip:[email protected]>
14:00:54.921  [CM505001]: Ext.102: Device info: Device Identified: [Man: Yealink;Mod: T28;Rev: General] Capabilities:[reinvite, replaces, unable-no-sdp, no-recvonly] UserAgent: [Yealink SIP-T28P 2.61.0.80] PBX contact: [sip:[email protected]:5060]
14:00:54.921  [CM503001]: Call(143): Incoming call from Ext.102 to <sip:[email protected]>
13:55:47.937  [CM503008]: Call(142): Call is terminated

 

[markshehan]

We would need to see a wireshark.

I can see calls in your log from those extensions (330 etc) and as you have your 3cx to prepend the queue name and then caller id
Main Number 330 is a valid display for your Ring Group on ext 500.

So either you have something in 330 (such as a dummy extension, ring group, etc.) or some one is trying to force an internal call from the outsite to probe your network (seen it done before) and the only way we will know that is with a wireshark on your 3cx.

 

[sbonner]

Thank you for your quick response!

I am looking into Wireshark now and am going to try and learn to use it by fire.

I went through the log and was able to account for all of the Extensions in it. The numbers that the site manager is complaining about, however, do not have any known extension assigned to them and are not associated with a queue or ring group.

 

[markshehan]

Thank you for your quick response!

I am looking into Wireshark now and am going to try and learn to use it by fire.

I went through the log and was able to account for all of the Extensions in it. The numbers that the site manager is complaining about, however, do not have any known extension assigned to them and are not associated with a queue or ring group.

A wireshark will tell you who or where the invite is coming from.

When you start wireshark go into capture options and turn off promiscuous mode for now (it lets you see all messages on the lan and you dont need that yet).

Then in the filter at the top - type in sip (just the 3 letters) and the bar will go green (good) and then hit Apply. Then you will only see sip messages.

For a call you will see some INVITE messages. For outgoing or internal you will see 2 invites, one from the extension to 3cx and then one from 3cx to another extension for internal or to your voip provider.

In those you should see the ip of the sender and some other information. So when you start seeing these rogue invites you can see who is sending them and their ip. Helps track it down.

If you dont see them it means it is something internal in 3cx (like a ring group etc.).

Also look at extensions for SIP ID (on the other tab) that may have a SIP ID that is one of these rogue extension numbers.

Then get back to us when you have some more information - we can help narrow it down for you

 

[jpillow]

look in your management console under the system extensions tab and that will show you all extensions nut just extensions assocaited with. ie voice mail 999, ring group 500 etc.....