Empty field in Call from

in CLI Asterisk 13.18.3 there is:

[Aug 17 10:13:57] NOTICE[1120][C-00000000]: chan_sip.c:26407 handle_request_invite: Call from ‘’ >>(181.29.4.3:5060) to extension ‘6000’ rejected because extension not found in context ‘public’.

i want to know who dial this.

in wireshark i saw all information in field for example “From: <7081@181.29.4.3:5060>”.

in chan_sip.c there is S_OR(p->username, p->peername), but why they are empty ?

Do you have allowguest enabled?

sip.conf allowguest=yes

but if i change it to no:

[Aug 17 11:58:07] NOTICE[1120][C-00000001]: chan_sip.c:26313 handle_request_invi te: Failed to authenticate device sip:7081@181.29.4.3;tag=413f9d30-3041db5-13c 4-50022-22c4300-27d6a032-22c4300

there is no dialed number

Asterisk doesn’t need to look at the dialled number as it has already rejected the call. You need the security log for details of the attacker.

thanks!

logger.conf: security => security

in /var/log/asterisk/security i have who dialed and dialed number but only if allowguest=no in sip.conf

That’s right. There is no security breach otherwise. If you have a legitimate need for allowguest (few people do), you will have to enable protocol debugging, or possibly include explicit dialplan to catch the wrong number and log relevant information.