5

We have one phone (123) that rings from time to time, displaying what seems like an internal number (6001), but it's not, because we don't use that number and nothing in that range. When you pick up the phone, you hear a dial tone.

The server runs Asterisk 1.4. Nothing is logged in the Master.log. Record call data for this phone is recorded to a CDR table in a database. I can see the number in the dst field (as well in the clid and src fields). When we get such a call, we don't see it in the table. As CDR logs call data, this seems logical, as there is no call, just a dial tone when you try to answer.

The phone display shows this:

line 1 & 2 ringing 123
6001
6001

I've grepped all log and config files for 6001. The messages log shows many entries for 6001, but strangely enough not at the time the phone rings:

NOTICE[22537] chan_sip.c: Failed to authenticate user 6001

This happens for another number as well, and I can find the same entries in messages.

Questions

  1. What is happening here?
  2. How can I see or log what's going on? So at the time the phone rings, I want to see a log entry somewhere.
  3. Is this a hack?

Update

The phone is replaced, the old one moved to my desk, with the same number and settings. Here it is on another LAN, other public IP, and since then I haven't seen any of these calls. The new phone, with a new number, doesn't get these calls, and the problem has disappeared. So it might be something on that network, which is not under my control.

Update 2

See Asterisk ghost calls for another try...

Community
  • 1
SPRBRN
  • 571
  • 4
  • 12
  • 28
  • `displaying what seems like an internal number (6001)` So... you've established that the call is coming from inside the house. `but it's not, because we don't use that number and nothing in that range` ...Voting to move to demonology SE. – Parthian Shot Mar 22 '16 at 15:58
  • Jokes and sarcasm aside, it's probably pretty easy to spoof a number. I see many connect attempts for that number, from the outside. – SPRBRN Mar 23 '16 at 11:38

2 Answers2

3

1. Well.. if there are failed auth attempts from that number, but you're getting calls from it "from time to time", there's a chance that sometimes, the auth attempt is successful. Try catching the ip address that registers with it by periodically checking asterisk -rx 'sip show peers' for that number.

EDIT (probably a better idea): When the phone rings, don't hang up and look at asterisk -rx 'core show channels' to see what channels are being used for this call. It is possible that the call originates from outside of your network, as the caller id is usually easy to fake.

2. Crank up the log level in logger.conf.

3. Maybe.

Fun fact, 6001 is the number used in Asterisks Hello World Tutorial: https://wiki.asterisk.org/wiki/display/AST/Hello+World

Marco
  • 435
  • 1
  • 3
  • 16
  • I've set the log level for messages to verbose (with daily logrotate to make sure it doesn't get out of hand). I understand setting log level to debug is not useful. – SPRBRN Mar 23 '16 at 11:36
  • The problem has disappeared by moving the phone to another location. I'm closing the question, and award you the points, even if this didn't make clear what really was happening. – SPRBRN Apr 12 '16 at 08:32
1

You don't say how large your installation is, but if it's small install the free edition of SecAst, and let it monitor registration and dial attempts. Start by letting it watch the 6001 extension (SIP/6001) and then the PBX in general. Depending on your settings it may be an external hacker trying extensions looking for DISA. A 6 followed by 001 could be the start of a dial-through attempt (6 for DISA, followed by 001 for start of an international call). This may also be a clue that someone is hacking your PBX and mapping your dialplan.

TSG
  • 1,674
  • 7
  • 32
  • 51
  • Thanks for the suggestion. We moved the phone to another location for testing, and the problem has gone. On the new location, other LAN and public IP, these calls don't happen. The new (and only) phone on the other location, with new number, doesn't get these calls either. My best guess is that it's a local issue on that network, which is not under my control. – SPRBRN Apr 11 '16 at 07:58