Event ID 30051 – Unidentified Incoming Call: Help identifying the source and correct configuration

[farman khan]

Hello 3CX Support Team,

Our 3CX PBX logged the following warning. Please help us identify its cause and the correct steps to resolve it.

Warning details

• Severity: Warning
• Event ID: 30051
• Date/time displayed: October 16, 2026, at 1:03 AM
• Message: “Unidentified Incoming Call. Review INVITE and adjust source identification.”

Relevant SIP INVITE details

The telephone numbers below are masked for this public post.

INVITE sip:[destination-number]@134.122.38.110:5060 SIP/2.0
Via: SIP/2.0/UDP 144.172.64.107:23868
Contact: <sip:[presented-caller-number]@144.172.64.107:23868;transport=UDP>
To: <sip:[destination-number]@134.122.38.110>
From: "[presented-caller-number]" <sip:[presented-caller-number]@134.122.38.110>
User-Agent: Bria
Content-Type: application/sdp

SDP connection address: 144.172.64.107
Audio port: 11780
The warning indicates that 3CX could not identify the incoming request. However, we have not yet confirmed whether it came from our SIP provider, a misconfigured softphone, or unsolicited SIP traffic. The “Bria” user-agent value is present in the request, but we cannot confirm the sender’s identity from that alone.

Could you please clarify:

1. What specifically causes Event ID 30051 in this case? Which part of this INVITE fails source identification?
2. How can we confirm the actual source? Which Activity Log entries or packet-capture details should we collect to distinguish legitimate provider traffic from a direct SIP request?
3. If this is legitimate trunk traffic, which Source Identification settings and SIP header fields should we check? Please advise how to configure these correctly without matching unrelated traffic to our trunk.
4. If this is unsolicited traffic, what firewall or 3CX security settings should we apply? Can SIP access be restricted to the provider’s published signaling addresses while preserving required access for our 3CX applications, SBCs, and remote phones?
5. Does this warning simply indicate that the request was rejected, or could it affect legitimate inbound calls, queue ringing, or system availability?
6. What additional information would you need, such as our exact 3CX version/build, trunk template, hosting details, firewall configuration, or a packet capture?

We would appreciate guidance on identifying the root cause and applying the appropriate fix. We can provide the complete log and unmasked details privately if required.

Thank you.

 

[Alejandro_3CX]

Hi @farman khan if you check the user agent is says Bria, so are you using this application? I dont think your voip provider is sending these INVITES under that user-agent, looks like more a spam call. Just for security reasons please make sure to read the following links and check your system is set properly:

• https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-1/
• https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-2/
• https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-3/
• https://www.3cx.com/blog/unified-communications/dont-be-that-guy-vol-4/
• https://www.3cx.com/blog/docs/pbx-security-best-practices/