This has been discussed on the list before. There is an "invite" coming from the outside. With SIP an invite can be sent, but unless the inviter can supply the proper credentials to place a call, it won't be passed by the proxy, and will "fail".
What it looks like is that someone found your sip server on the net and tried to see if they could dial international calls. While not something you might feel good about, it happens, and as long as your sip credentials are not easily guessed you are probably ok. If, for example, you do not need international calling, ensure at your provider that it is turned off. Your firewall logs might also prove useful in determining where this originated so you can protect against it. ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: [email protected] <[email protected]> To: gabriel <[email protected]>; [email protected] <[email protected]> Sent: Wed Apr 07 04:35:39 2010 Subject: Re: [sipx-users] cdr entries Those are attempts at dialing euro numbers. > -----Original Message----- > From: [email protected] [mailto:sipx-users- > [email protected]] On Behalf Of gabriel > Sent: Tuesday, April 06, 2010 9:55 PM > To: [email protected] > Subject: [sipx-users] cdr entries > > > I had some problems with my server today, all the phones lost > registration > and the server wouln't accept calls from the trunk. > > I restarted it with /etc/init.d/sipxecs restart and it all came back, > just > noticed some entries in the cdr log > > From > > To > > Start > > Duration > > Status > > sip 011442076380569 4/6/10 5:41 PM 0 seconds Failed > sip 00442072221234 4/6/10 5:41 PM 0 seconds Failed > sip 900441712674466 4/6/10 5:41 PM 0 seconds Failed > sip 9011442076268616 4/6/10 5:41 PM 0 seconds Failed > sip 0011442072221234 4/6/10 5:41 PM 0 seconds Failed > sip 0000442075005000 4/6/10 5:41 PM 0 seconds Failed > sip 000441223311371 4/6/10 5:41 PM 0 seconds Failed > sip 001441625433822 4/6/10 5:41 PM 0 seconds Failed > sip 1442084714884 4/6/10 5:41 PM 0 seconds Failed > > > and so on. > what does it mean when the from field is "sip" Does it mean these calls > where maybe unauthenticated calls from the internet ? I went ahead and > added an access list on the firewall that restricts the incoming > traffic > allowing only the traffic from my ITSP provider. > > any idea what these entries might be ? Or which log file should I look > for > more info ? > > thanks > -gabriel > _______________________________________________ > sipx-users mailing list [email protected] > List Archive: http://list.sipfoundry.org/archive/sipx-users > Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users > sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/
