Is it possible to read out from the trunk of the inncomming call came?

[Hakedalen Telefonforening]

I have got calls from a strange number, and I am not able to identify from where it came in.
Is it a way to identify that?

 

[leejor]

The 3CX Activity Log will show where the call came from (the trunk), if it passed through the PBX, and was not a Direct SIP call to your set.

 

[Hakedalen Telefonforening]

Thank you, but I do actually not understand how I can read it out of this:

11/19/2020 4:02:33 AM - [CM503003]: Call(C:394): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 192.168.1.8:5060

11/19/2020 4:02:33 AM - [CM503003]: Call(C:394): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 192.168.1.21:5060

 

[Hakedalen Telefonforening]

The call lag states: ( xxx replace line info.)

11/19/2020 4:02:09 AM

893191

RGxxxxxxxxx

Not Answered

 

[nub]

You should see outside calls coming from a trunk number:

11/11/1911 1:11:11 AM - [CM000001]: Call(C:001): Calling T:Line:10001>>5555551212@[Dev:sip:[email protected]:5060]

in that example 10001 is the trunk number the call came from ip, 8.8.8.8 and 5555551212 is the caller id.

 

[Hakedalen Telefonforening]

Can not see anything like that, but I get this error all time, what may I do to solve that?

11/21/2020 7:18:15 AM - [CM306002]: There is no valid STUN server specified! External IP can not be resolved.
11/21/2020 6:58:15 AM - There's another STUN server that resolves to the same IP: 54.37.20.144:3478/UNKNOWN_TRANSPORT fk=0 tgt=; ignored

 

[nub]

i would start with a little proof of concept, make a call with a known quantity, your cell phone at a known time lets say 8:00am.

cell phones calls pbx @ 8:00am dials your ext and you talk for 5 seconds and the cell hangs up.

Now we take a look at the activity log at 8:00am

We are looking for how your cell call is handled, my guess is you will see something like " incoming INVITE from Line " and you will see a sip ip address and your cell number phrased in a line, we are just learning how to read the activity log.

Now we take what we learned from our test call, how the call is phrased in the activity log, the sip ip address and we compare it to the bad call.

best of luck.

 

[leejor]

..in addition, I would not worry too much about the STUN logs.

See...
https://www.3cx.com/community/threads/theres-another-stun-server-that-resolves-to-the-same-ip.66345/

Old links, and the 3CX menus have changed, as versions evolved, but still some helpful information...

https://www.3cx.com/blog/docs/3cx-server-activity-log/

https://www.3cx.com/blog/docs/server-activity-log-example-1/

 

[Hakedalen Telefonforening]

I called from my cellphone to my phone number, the call did go trough just as it should but the log tells about ..failed... I do not recognize any numberes here except from sip:36@ since I answered on line 36

11/21/2020 5:55:33 PM - [CM503003]: Call(C:409): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 127.0.0.1:5483

11/21/2020 5:55:33 PM - [CM503003]: Call(C:409): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 192.168.1.68:5060

 

[leejor]

11/21/2020 5:55:33 PM - [CM503003]: Call(C:409): Call to <sip:[email protected]:0> has failed; Cause: 487 Request Terminated/INVITE from 192.168.1.68:5060

This would be the last log (of a sequence, call # 409)) for that call.
Is the local IP of your 3CX Server 192.168.1.111, and the IP of extension 36, 192.168.1.68? Then it shows the call went to that extension, but does not appear to have been answered, it was terminated (for some reason), by the extension IP.

You should be able to work back, in time, in the log, and find earlier call 409 logs showing the call origination, the incoming trunk INVITE.

 

[Hakedalen Telefonforening]

This would be the last log (of a sequence, call # 409)) for that call.
Is the local IP of your 3CX Server 192.168.1.111, and the IP of extension 36, 192.168.1.68? Then it shows the call went to that extension, but does not appear to have been answered, it was terminated (for some reason), by the extension IP.

You should be able to work back, in time, in the log, and find earlier call 409 logs showing the call origination, the incoming trunk INVITE.

No it was not terminated,
Is the local IP of your 3CX Server 192.168.1.111 Yes, and the extension was no 36, but it had also a local IP: 192.168.1.217, both are fixed IP.
The 2 lines was all from the last half hour.
The good thing is that it works well for all extensions in the 192.168.1 range. Trunks are working.
I had no problems before that call came in with Russian speaking from a number 893191. I did put it in the blacklist, but still it came in, and I started to investigate. The call log did not tell me anything so I discovered that we had other logs.

I have to admit that IP telephony is interesting, but I use it for my home number and to a really museum exchange who are so old that it do not have a single semiconductor

I did choose 3CX because it is relatively easy to set up and to understand. Much more easy than to learn Linux. An it is running just fine on a raspberry pi.

 

[leejor]

Place a call from outside 3CX, answer the call on the extension. Check the Activity Log. You should see the call from start to end. that is what you would be looking for, if those calls come in, over a trunk, again. there is a possibility that you are receiving Direct SIP calls to the set, in which case there will be no log in 3CX. Some sets have options to prevent this, blockig any calls unless they come from your SIP server. Before you begin looking into that, you need to confirm how they route to the set.

 

[Hakedalen Telefonforening]

The log tells nothing about the call. I called no in the middle of the night, and the voicemail answered, and sent the recording to email. Here is the log, and the call log. (last 3 digits in my cell phone number is replaced by xxx by me.)

11/22/2020 4:57:28 AM - [CM306002]: There is no valid STUN server specified! External IP can not be resolved.
11/22/2020 4:37:28 AM - There's another STUN server that resolves to the same IP: 54.37.20.144:3478/UNKNOWN_TRANSPORT fk=0 tgt=; ignored
11/22/2020 4:37:01 AM - [EC100009]: External application [Hakadalexchange:0/PbxConfigTool] is disconnected:

Date/Time​	From​	To​	Talking​
11/22/2020 4:53:34 AM	+4790893xxx	VMail (33)	00:00:14

 

[leejor]

You might try changing the Activity Log logging level to Verbose, to see if there is more information.

 

[Hakedalen Telefonforening]

That gave reasonable info. Than you!