Constant Calls from 99 or 1000

Status
Not open for further replies.

Matthew Main

Member
Jan 24, 2017
92
5
8
39
Hi guys

i am getting calls from 99 or 1000

nothing is showing on the server. and no ext on the domain that match

any ideas?

kind regards

Matt
 

DigitalDaz

Administrator
Staff member
Sep 29, 2016
3,038
556
113
They won't be coming through the PBX, probably hitting your router directly. Try switching to TCP, that will probably force your registration to a random high port.
 

EasyBB

Active Member
Oct 23, 2016
240
33
28
Australia
Any port forwarding on the router or uPnP enabled?

Edit: Just saw DigitalDaz's post below so I believe your Fusion is on a public IP.
 

DigitalDaz

Administrator
Staff member
Sep 29, 2016
3,038
556
113
My guess is that it is highly likely using UDP that the port being displayed in the sip registrations page is at or around 5060, if so, its just hackers having a stab.

Depending on the phone you can mitigate it there, yealinks for example have a setting to only allow trust server, ie the one you are registered to.

This is very common, also, in general TCP just handles everything better anyway so that's usually the easiest method to deal with it..
 

DigitalDaz

Administrator
Staff member
Sep 29, 2016
3,038
556
113
You also want to either enable TCP on your DIDs now from Simwood or you are probably getting fragmented UDP packets inbound due to the new stack.
 

hailthemelody

Member
Dec 9, 2017
53
5
8
Hi @Matthew Main and @DigitalDaz

If it's appropriate (ie - doesn't compromise security), would you mind posting any solutions/troubleshooting steps that could be helpful to others? I'm seeming some of these requests hitting my PBX and want to ensure Fail2Ban is capturing them appropriately. Or maybe there's another solution etc.
 
Status
Not open for further replies.