Asterisk – Troubleshooting Phone Rings Without Call or Log Entries

asterisklogging

We have one phone (123) that rings from time to time, displaying what seems like an internal number (6001), but it's not, because we don't use that number and nothing in that range. When you pick up the phone, you hear a dial tone.

The server runs Asterisk 1.4. Nothing is logged in the Master.log. Record call data for this phone is recorded to a CDR table in a database. I can see the number in the dst field (as well in the clid and src fields). When we get such a call, we don't see it in the table. As CDR logs call data, this seems logical, as there is no call, just a dial tone when you try to answer.

The phone display shows this:

line 1 & 2 ringing 123
6001
6001

I've grepped all log and config files for 6001. The messages log shows many entries for 6001, but strangely enough not at the time the phone rings:

NOTICE[22537] chan_sip.c: Failed to authenticate user 6001

This happens for another number as well, and I can find the same entries in messages.

Questions

  1. What is happening here?
  2. How can I see or log what's going on? So at the time the phone rings, I want to see a log entry somewhere.
  3. Is this a hack?

Update

The phone is replaced, the old one moved to my desk, with the same number and settings. Here it is on another LAN, other public IP, and since then I haven't seen any of these calls. The new phone, with a new number, doesn't get these calls, and the problem has disappeared. So it might be something on that network, which is not under my control.

Update 2

See Asterisk ghost calls for another try…

Best Answer

1. Well.. if there are failed auth attempts from that number, but you're getting calls from it "from time to time", there's a chance that sometimes, the auth attempt is successful. Try catching the ip address that registers with it by periodically checking asterisk -rx 'sip show peers' for that number.

EDIT (probably a better idea): When the phone rings, don't hang up and look at asterisk -rx 'core show channels' to see what channels are being used for this call. It is possible that the call originates from outside of your network, as the caller id is usually easy to fake.

2. Crank up the log level in logger.conf.

3. Maybe.

Fun fact, 6001 is the number used in Asterisks Hello World Tutorial: https://wiki.asterisk.org/wiki/display/AST/Hello+World

Related Topic