Toggle sidebar Toggle sidebar

Server swap, license activated but over limit??? Help!

Status
Not open for further replies.

scythe000

Joined
Nov 8, 2011
Messages
66
Reaction score
0
Server died, restored from backup to new hardware. Got the license activated and all seems well, but after a while, I hit 32 simultaneous call, and i have a 16 call limit. I know for a fact that nobody is on the phones right now. Any ideas? Help!
 
Here's a log showing phantom calls:

Code: 
2-Dec-2014 00:14:28.568	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:28.447	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:14:27.366	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:27.246	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:24.617	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:24.495	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:14:23.415	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:23.295	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:22.510	Currently active calls - 7: [11,16,17,18,19,21,22]
02-Dec-2014 00:14:21.819	Leg L:14.5[VMail] is terminated: Cause: BYE from PBX
02-Dec-2014 00:14:21.819	[CM503008]: Call(C:14): Call is terminated
02-Dec-2014 00:14:21.817	Leg L:14.1[Line:10001<<8052168324] is terminated: Cause: BYE from 172.16.252.250:5060
02-Dec-2014 00:14:20.969	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:20.847	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:14:20.775	NAT/ALG check:L:17.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:20.694	NAT/ALG check:L:17.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:14:19.616	NAT/ALG check:L:17.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:19.495	NAT/ALG check:L:17.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:18.253	Leg L:20.2[Line:10001>>18672925483] is terminated: Cause: BYE from PBX
02-Dec-2014 00:14:18.252	[CM503008]: Call(C:20): Call is terminated
02-Dec-2014 00:14:18.234	Leg L:20.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:14:15.965	NAT/ALG check:L:20.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:15.844	NAT/ALG check:L:20.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:15.525	[CM503007]: Call(C:21): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:14:15.524	[CM503007]: Call(C:21): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:14:15.523	L:21.2[Line:10001>>18672925483] has joined to L:21.1[Extn]
02-Dec-2014 00:14:15.522	NAT/ALG check:L:21.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:13.419	NAT/ALG check:L:20.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:14:13.296	NAT/ALG check:L:20.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:14:12.139	Leg L:2.3[Line:10001>>18672925483] is terminated: Cause: BYE from PBX
02-Dec-2014 00:14:12.139	[CM503008]: Call(C:2): Call is terminated
02-Dec-2014 00:14:12.136	Leg L:2.2[Line:10001>>18672925483] is terminated: Cause: BYE from 172.16.252.250:5060
02-Dec-2014 00:14:03.113	[CM503007]: Call(C:20): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:14:03.112	[CM503007]: Call(C:20): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:14:03.105	L:20.2[Line:10001>>18672925483] has joined to L:20.1[Extn]
02-Dec-2014 00:14:03.105	NAT/ALG check:L:20.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:55.106	[CM503025]: Call(C:22): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:22.1[Extn]
02-Dec-2014 00:13:54.772	[CM503027]: Call(C:22): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:54.772	[CM503004]: Call(C:22): Route 1: from L:22.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:54.772	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 7; limit is 23
02-Dec-2014 00:13:54.772	Call(C:22): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:54.770	[CM503001]: Call(C:22): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:54.769	NAT/ALG check:L:22.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:54.421	[CM503025]: Call(C:21): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:21.1[Extn]
02-Dec-2014 00:13:54.397	[CM503027]: Call(C:21): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:54.397	[CM503004]: Call(C:21): Route 1: from L:21.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:54.397	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 6; limit is 23
02-Dec-2014 00:13:54.397	Call(C:21): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:54.395	[CM503001]: Call(C:21): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:54.395	NAT/ALG check:L:21.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:53.568	[CM503025]: Call(C:20): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:20.1[Extn]
02-Dec-2014 00:13:53.519	[CM503027]: Call(C:20): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:53.519	[CM503004]: Call(C:20): Route 1: from L:20.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:53.519	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 5; limit is 23
02-Dec-2014 00:13:53.519	Call(C:20): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:53.516	[CM503001]: Call(C:20): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:53.515	NAT/ALG check:L:20.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:53.348	[CM503025]: Call(C:19): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:19.1[Extn]
02-Dec-2014 00:13:53.094	[CM503027]: Call(C:19): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:53.094	[CM503004]: Call(C:19): Route 1: from L:19.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:53.094	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 4; limit is 23
02-Dec-2014 00:13:53.094	Call(C:19): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:53.092	[CM503001]: Call(C:19): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:53.092	NAT/ALG check:L:19.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:50.718	Leg L:18.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:13:50.510	Currently active calls - 6: [2,11,14,16,17,18]
02-Dec-2014 00:13:50.283	NAT/ALG check:L:18.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:50.273	Leg L:15.1[Extn] is terminated: Cause: BYE from PBX
02-Dec-2014 00:13:50.273	[CM503008]: Call(C:15): Call is terminated
02-Dec-2014 00:13:50.268	Leg L:15.2[Line:10001>>18672925483] is terminated: Cause: BYE from 172.16.252.250:5060
02-Dec-2014 00:13:50.257	[CM503007]: Call(C:18): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:50.254	L:18.3[Line:10001>>18672925483] has joined to L:18.2[Line:10001>>18672925483]
02-Dec-2014 00:13:50.254	NAT/ALG check:L:18.3[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:50.177	[CM503025]: Call(C:18): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:18.2[Line:10001>>18672925483]
02-Dec-2014 00:13:49.569	NAT/ALG check:L:18.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:49.448	NAT/ALG check:L:18.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:46.420	NAT/ALG check:L:18.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:46.299	NAT/ALG check:L:18.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:45.457	NAT/ALG check:L:15.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:45.349	NAT/ALG check:L:15.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:44.621	NAT/ALG check:L:18.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:44.499	NAT/ALG check:L:18.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:41.317	Leg L:16.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:13:40.896	NAT/ALG check:L:16.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:40.759	Leg L:12.1[Extn] is terminated: Cause: BYE from PBX
02-Dec-2014 00:13:40.758	[CM503008]: Call(C:12): Call is terminated
02-Dec-2014 00:13:40.757	Leg L:12.2[Line:10001>>18672925483] is terminated: Cause: BYE from 172.16.252.250:5060
02-Dec-2014 00:13:40.755	[CM503007]: Call(C:16): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:40.752	L:16.3[Line:10001>>18672925483] has joined to L:16.2[Line:10001>>18672925483]
02-Dec-2014 00:13:40.751	NAT/ALG check:L:16.3[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:40.686	[CM503025]: Call(C:16): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:16.2[Line:10001>>18672925483]
02-Dec-2014 00:13:40.071	NAT/ALG check:L:16.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:39.950	NAT/ALG check:L:16.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:29.072	NAT/ALG check:L:17.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:28.951	NAT/ALG check:L:17.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:28.552	[CM503007]: Call(C:14): VMail:9999 has joined, contact <sip:[email protected]:40600>
02-Dec-2014 00:13:28.544	[CM503007]: Call(C:14): Line:10001<<8052168324 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:28.542	L:14.5[VMail] has joined to L:14.1[Line:10001<<8052168324]
02-Dec-2014 00:13:28.542	NAT/ALG check:L:14.5[VMail] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:28.124	[CM503007]: Call(C:18): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:28.123	[CM503007]: Call(C:18): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:13:28.121	L:18.2[Line:10001>>18672925483] has joined to L:18.1[Extn]
02-Dec-2014 00:13:28.121	NAT/ALG check:L:18.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:27.985	[CM503007]: Call(C:17): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:27.984	[CM503007]: Call(C:17): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:13:27.981	L:17.2[Line:10001>>18672925483] has joined to L:17.1[Extn]
02-Dec-2014 00:13:27.981	NAT/ALG check:L:17.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:27.588	Leg L:14.3[Extn] is terminated: Cause: 487 Request Cancelled/INVITE from 172.16.252.40:5060
02-Dec-2014 00:13:27.586	[CM503003]: Call(C:14): Call to "6311" <sip:[email protected]:5060> has failed; Cause: 487 Request Cancelled/INVITE from 172.16.252.40:5060
02-Dec-2014 00:13:27.586	Leg L:14.4[Extn] is terminated: Cause: 487 Request Cancelled/INVITE from 172.16.252.51:5060
02-Dec-2014 00:13:27.583	[CM503003]: Call(C:14): Call to "Botti Morrison" <sip:[email protected]:5060> has failed; Cause: 487 Request Cancelled/INVITE from 172.16.252.51:5060
02-Dec-2014 00:13:27.577	[CM503007]: Call(C:16): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:27.576	[CM503007]: Call(C:16): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:13:27.574	L:16.2[Line:10001>>18672925483] has joined to L:16.1[Extn]
02-Dec-2014 00:13:27.574	NAT/ALG check:L:16.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:27.573	[CM503025]: Call(C:14): Calling T:VMail:9999@[Dev:sip:[email protected]:40600;rinstance=1387f0f283e3da1e] for L:14.1[Line:10001<<8052168324]
02-Dec-2014 00:13:27.530	[CM503005]: Call(C:14): Forwarding: T:VMail:9999@[Dev:sip:[email protected]:40600;rinstance=1387f0f283e3da1e]
02-Dec-2014 00:13:27.530	L:14.1[Line:10001<<8052168324] forwards call from RingAll:4014 to VMail:9999 based on rule
02-Dec-2014 00:13:27.530	L:14.1[Line:10001<<8052168324] failed to reach RingAll:4014, reason No Answer
02-Dec-2014 00:13:26.743	[CM503007]: Call(C:15): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:26.742	[CM503007]: Call(C:15): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:13:26.741	L:15.2[Line:10001>>18672925483] has joined to L:15.1[Extn]
02-Dec-2014 00:13:26.741	NAT/ALG check:L:15.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:24.462	[CM503025]: Call(C:18): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:18.1[Extn]
02-Dec-2014 00:13:24.434	[CM503027]: Call(C:18): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:24.434	[CM503004]: Call(C:18): Route 1: from L:18.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:24.434	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 4; limit is 23
02-Dec-2014 00:13:24.434	Call(C:18): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:24.432	[CM503001]: Call(C:18): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:24.432	NAT/ALG check:L:18.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:24.181	[CM503025]: Call(C:17): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:17.1[Extn]
02-Dec-2014 00:13:24.132	[CM503027]: Call(C:17): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:24.132	[CM503004]: Call(C:17): Route 1: from L:17.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:24.132	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 3; limit is 23
02-Dec-2014 00:13:24.132	Call(C:17): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:24.123	[CM503001]: Call(C:17): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:24.122	NAT/ALG check:L:17.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:23.810	[CM503025]: Call(C:16): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:16.1[Extn]
02-Dec-2014 00:13:23.769	[CM503027]: Call(C:16): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:23.769	[CM503004]: Call(C:16): Route 1: from L:16.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:23.769	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 2; limit is 23
02-Dec-2014 00:13:23.769	Call(C:16): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:23.767	[CM503001]: Call(C:16): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:23.767	NAT/ALG check:L:16.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:23.208	[CM503025]: Call(C:15): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:15.1[Extn]
02-Dec-2014 00:13:23.169	[CM503027]: Call(C:15): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:23.169	[CM503004]: Call(C:15): Route 1: from L:15.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:23.169	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 1; limit is 23
02-Dec-2014 00:13:23.169	Call(C:15): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:13:23.167	[CM503001]: Call(C:15): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:13:23.166	NAT/ALG check:L:15.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:20.492	Currently active calls - 4: [2,11,12,14]
02-Dec-2014 00:13:15.371	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:15.252	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:14.170	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:14.050	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:12.573	Leg L:14.2[Extn] is terminated: Cause: 487 Request Cancelled/INVITE from 172.16.252.54:5060
02-Dec-2014 00:13:12.572	[CM503003]: Call(C:14): Call to "8071" <sip:[email protected]:5060> has failed; Cause: 487 Request Cancelled/INVITE from 172.16.252.54:5060
02-Dec-2014 00:13:12.514	[CM503025]: Call(C:14): Calling T:RingAll:4014@[Dev:sip:[email protected]:5060,Dev:sip:[email protected]:5060] for L:14.1[Line:10001<<8052168324]
02-Dec-2014 00:13:12.504	[CM503025]: Call(C:14): Calling T:RingAll:4014@[Dev:sip:[email protected]:5060,Dev:sip:[email protected]:5060] for L:14.1[Line:10001<<8052168324]
02-Dec-2014 00:13:12.451	[CM503005]: Call(C:14): Forwarding: T:RingAll:4014@[Dev:sip:[email protected]:5060,Dev:sip:[email protected]:5060]
02-Dec-2014 00:13:12.451	L:14.1[Line:10001<<8052168324] forwards call from HuntGrp:4013 to RingAll:4014 based on rule
02-Dec-2014 00:13:12.450	L:14.1[Line:10001<<8052168324] failed to reach HuntGrp:4013, reason No Answer
02-Dec-2014 00:13:12.150	Leg L:11.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:13:11.727	NAT/ALG check:L:11.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:11.608	Leg L:13.1[Extn] is terminated: Cause: BYE from PBX
02-Dec-2014 00:13:11.607	[CM503007]: Call(C:11): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:13:11.607	[CM503008]: Call(C:13): Call is terminated
02-Dec-2014 00:13:11.605	Leg L:13.2[Line:10001>>18672925483] is terminated: Cause: BYE from 172.16.252.250:5060
02-Dec-2014 00:13:11.603	L:11.3[Line:10001>>18672925483] has joined to L:11.2[Line:10001>>18672925483]
02-Dec-2014 00:13:11.603	NAT/ALG check:L:11.3[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:11.533	[CM503025]: Call(C:11): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:11.2[Line:10001>>18672925483]
02-Dec-2014 00:13:10.921	NAT/ALG check:L:11.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:10.802	NAT/ALG check:L:11.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:09.922	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:09.802	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:08.787	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:08.668	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:07.424	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:07.303	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:03.622	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:03.504	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:01.320	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:01.201	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:13:00.121	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:13:00.053	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:57.423	[CM503025]: Call(C:14): Calling T:HuntGrp:4013@[Dev:sip:[email protected]:5060] for L:14.1[Line:10001<<8052168324]
02-Dec-2014 00:12:57.396	[CM503027]: Call(C:14): From: Line:10001<<8052168324 ("8052168324" <sip:[email protected]:5060>)  to  T:HuntGrp:4013@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:12:57.396	[CM503004]: Call(C:14): Route 1: from L:14.1[Line:10001<<8052168324] to T:HuntGrp:4013@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:12:57.328	[CM503001]: Call(C:14): Incoming call from Line:10001<<8052168324 to <sip:[email protected]:5060>
02-Dec-2014 00:12:57.328	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 1; limit is 23
02-Dec-2014 00:12:57.328	NAT/ALG check:L:14.1[Line:10001<<8052168324] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:57.321	[CM503012]: Inbound any hours rule (unnamed) for 10001 forwards to DN:4013
02-Dec-2014 00:12:51.356	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:51.235	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:50.441	Currently active calls - 4: [2,11,12,13]
02-Dec-2014 00:12:50.223	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:50.105	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:49.325	NAT/ALG check:L:11.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:49.254	NAT/ALG check:L:11.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:48.830	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:48.753	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:47.676	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:47.573	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:45.226	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:45.106	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:44.040	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:43.907	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:43.265	Leg L:10.1[Extn] is terminated: Cause: BYE from PBX
02-Dec-2014 00:12:43.223	[CM503020]: Call(C:10): Normal call termination. Call originator: Extn:1000. Reason: Not available
02-Dec-2014 00:12:43.223	L:10.1[Extn] failed to reach Line:10001>>18672925483, reason Temporarily Unavailable
02-Dec-2014 00:12:43.214	Leg L:10.2[Line:10001>>18672925483] is terminated: Cause: 480 Temporarily not available/INVITE from 172.16.252.250:5060
02-Dec-2014 00:12:43.213	Call to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] from L:10.1[Extn] failed, cause: Cause: 480 Temporarily not available/INVITE from 172.16.252.250:5060
02-Dec-2014 00:12:43.212	[CM503003]: Call(C:10): Call to <sip:[email protected]:5060> has failed; Cause: 480 Temporarily not available/INVITE from 172.16.252.250:5060
02-Dec-2014 00:12:41.776	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:41.656	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:40.173	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:40.053	NAT/ALG check:L:12.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:37.069	Leg L:8.2[Line:10001>>18672925483] is terminated: Cause: BYE from PBX
02-Dec-2014 00:12:37.069	[CM503008]: Call(C:8): Call is terminated
02-Dec-2014 00:12:37.051	Leg L:8.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:12:34.728	[CM503007]: Call(C:8): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:12:34.727	[CM503007]: Call(C:8): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:12:34.725	L:8.2[Line:10001>>18672925483] has joined to L:8.1[Extn]
02-Dec-2014 00:12:34.724	NAT/ALG check:L:8.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:30.547	[CM503007]: Call(C:13): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:12:30.546	[CM503007]: Call(C:13): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:12:30.545	L:13.2[Line:10001>>18672925483] has joined to L:13.1[Extn]
02-Dec-2014 00:12:30.545	NAT/ALG check:L:13.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:26.010	[CM503007]: Call(C:12): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:12:26.009	[CM503007]: Call(C:12): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:12:26.005	L:12.2[Line:10001>>18672925483] has joined to L:12.1[Extn]
02-Dec-2014 00:12:26.005	NAT/ALG check:L:12.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:18.439	Currently active calls - 6: [2,8,10,11,12,13]
02-Dec-2014 00:12:09.463	Leg L:9.2[Line:10001>>18672925483] is terminated: Cause: BYE from PBX
02-Dec-2014 00:12:09.462	[CM503008]: Call(C:9): Call is terminated
02-Dec-2014 00:12:09.445	Leg L:9.1[Extn] is terminated: Cause: BYE from 37.75.211.188:14829
02-Dec-2014 00:12:07.821	NAT/ALG check:L:11.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:12:07.708	NAT/ALG check:L:11.1[Extn] REQUEST 'INVITE' - some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop
			   Media session IP ('c=' attribute) is not equal to the IP specified in contact header:
			      Media session IP:0.0.0.0
			      Contact IP:37.75.211.188
			   Media session IP ('c=' attribute) is not equal to the SIP packet source(IP:port):
			      Media session IP: 0.0.0.0
			      Received from: 37.75.211.188
02-Dec-2014 00:12:04.468	[CM503007]: Call(C:9): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:12:04.468	[CM503007]: Call(C:9): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:12:04.466	L:9.2[Line:10001>>18672925483] has joined to L:9.1[Extn]
02-Dec-2014 00:12:04.466	NAT/ALG check:L:9.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:11:50.909	[CM503007]: Call(C:11): Line:10001>>18672925483 has joined, contact <sip:[email protected]:5060>
02-Dec-2014 00:11:50.908	[CM503007]: Call(C:11): Extn:1000 has joined, contact <sip:[email protected]:14829>
02-Dec-2014 00:11:50.905	L:11.2[Line:10001>>18672925483] has joined to L:11.1[Extn]
02-Dec-2014 00:11:50.905	NAT/ALG check:L:11.2[Line:10001>>18672925483] RESPONSE 200 on 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:11:48.977	[CM503025]: Call(C:13): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:13.1[Extn]
02-Dec-2014 00:11:48.673	[CM503027]: Call(C:13): From: Extn:1000 (<sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:11:48.673	[CM503004]: Call(C:13): Route 1: from L:13.1[Extn] to T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
02-Dec-2014 00:11:48.673	Line limit check: Current # of calls for line Lc:10001(@TCAST-4960[<sip:[email protected]:5060>]) is 6; limit is 23
02-Dec-2014 00:11:48.673	Call(C:13): Call from Extn:1000 to 18672925483 matches outbound rule 'Rule for TCAST-4960'
02-Dec-2014 00:11:48.672	[CM503001]: Call(C:13): Incoming call from Extn:1000 to <sip:[email protected]:5060>
02-Dec-2014 00:11:48.672	NAT/ALG check:L:13.1[Extn] REQUEST 'INVITE' - basic check passed. No information for extended checks
02-Dec-2014 00:11:48.318	Currently active calls - 6: [2,8,9,10,11,12]
 
Is it possible I'm being hacked? I keep seeing extension 1000 call 867-292-5483 all by itself. It opens five lines to do it.

Code: 
02-Dec-2014 00:26:55.575	[CM503025]: Call(C:79): Calling T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060] for L:79.1[Extn]
02-Dec-2014 00:26:55.523	[CM503027]: Call(C:79): From: Extn:1000 ("1000" <sip:[email protected]:5060>)  to  T:Line:10001>>18672925483@[Dev:sip:[email protected]:5060]
 
If you have any reason to suspect hacking, especially from a particular extension, change the password for that extension immediately. Then re-provision the set with the new password. If you originally assigned easy to guess passwords to a number of extensions, change them all, now.

scythe000 said:
From: Extn:1000 ("1000" <sip:1000@66.214.183.92:5060>)
Click to expand...
.

Is this an IP you recognize?
 
That's my public IP. I'll change the password. Is there any way I can prevent these connections?
 
scythe000 said:
Is there any way I can prevent these connections?
Click to expand...

If it is hacking, there is usually a period where the hacker is phishing for the correct password. At that time 3CX will block depending on the criteria you have set, and blacklist the IP for a given time. You should have your notifications set-up to send you an email when this happens. If you see an IP come up repeatedly, go in to the security options and blacklist it permanently.

Many times they will re-try a while later, sometimes from a slightly different IP address. Some hackers will attempt a direct SIP call rather than registering. 3CX is quite good at blocking these. There is an option in 3CX to allow direct SIP calls, and if you don't make use of the feature, it should probably be disabled.

Implementing passwords that are not easy to guess, random characters are best, is highly recommended for any installation. If your company does not place calls, or many, to high cost destinations/countries, then the outbound rules can be modified to block attempts to call these numbers. A special prefix can be required for those that need to call them.
 
Thanks!
Looks like all calls were originating from extension 1000 and 1001. I deleted 1001, since it's not in use, then changed the password and disabled outbound calling for extension 1000.

It looks like it was rolling through random 8xx numbers. Maybe an autodialer phishing for live numbers?

Also, should I worry about these entries in my logs?

Code: 
02-Dec-2014 08:27:59.064   [CM506004]: STUN request to STUN server 192.95.0.175:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:56.053   [CM506004]: STUN request to STUN server 192.95.0.175:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:53.030   [CM506004]: STUN request to STUN server 192.95.0.175:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:49.982   [CM506004]: STUN request to STUN server 192.95.0.175:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:46.735   [CM506004]: STUN request to STUN server 94.198.96.7:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:43.601   [CM506004]: STUN request to STUN server 198.50.247.220:3478 has timed out; used Transport: 172.16.252.5:5060
02-Dec-2014 08:27:40.580   [CM506001]: STUN request to resolve SIP external IP:port mapping is sent to STUN server 198.50.247.220:3478 over Transport 172.16.252.5:5060
 
I've seen those as well.

If everything is working, otherwise, i wouldn't worry too much. There are places for 3 STUN server settings in the PBX. If you are really concerned, you can try changing those, but it may be timing out for a number of reasons. Any public STUN server should work. If you do a search you will come up with a number of sites that can be used.

Many 3CX users do not require STUN and simply disable it.
 
I thought I read I needed it unless my 3CX server was directly connected to the internet. In this case, it has a router attached to it.
 
See the second point...http://www.3cx.com/blog/voip-howto/stun-resolution/

You may not require it if all required port forwarding is in place, and working correctly.
 
Gotcha. Since my firewall tests come back okay, I guess I can disable it?
 
Status
Not open for further replies.

Latest Posts

Members Online Now

No members online now.
Total: 331 (members: 0, guests: 331)

Forum statistics

Threads
111,835
Messages
589,289
Members
164,665
Latest member
dominik.pepel
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom