IP phone keeps ringing

[Heath]

I have extension that has 3 phones on it, plus the 3CX client on my iPhone. What is happening 1 of the phones keeps ringing every 10 minutes and says it's calling from an extension that's not even in my office. My extension config are 3 digits and it says it's coming from an 4 digit extension. When I answer it no one there. But what is interesting is only 1 phone of the 3 phones rings. None of the other 2 or the 3CX client. And can't figure how and why or what's going on. And it's every 10 min this is happening

 

[eddv123]

Hi Heath,

My advice would be to run a PCAP trace from the System as well as getting a VERBOSE Support info file from the 3CX system. You can do this all from the same location in v15.5 SP1.

If you are unfamiliar with this process:

* Go to Activity log in the 3CX Phone System.

* Purge the logs and then under settings put them into "VERBOSE" mode.

* In v15.5 there is a new "capture" button for a PCAP capture.

Let the fault re-appear and once happy you have captured it sufficiently go back to your PBX interface main screen, go to "Support" and Generate the full support info logs. The PCAP capture once run will prompt you to download straight after running it.

Once you have both have a look with Wireshark (for the PCAP) and the binary log viewer (bldef file in the logs folder of the Support info file) and see if you can see this extension and more importantly where they are ringing from.

Since you are saying you are getting ghost calls from an extension number not related to your 3CX System as a precaution you should check you are not being SIP Hacked see the below as the symptoms:
https://www.linkedin.com/pulse/how-block-ghost-calls-coming-from-100100010000-your-yealink-nadeau

If there is anything in the logging that you think is relevant let us know.

 

[serverwork]

In the past, when we've seen this, the end-users had a router that had Port Scanning enabled on it. Disabling that shut down the ghost calls.