Why does this pbx keep calling and ringing one of my extensions?? I’m not seeing anything in the log files regarding this!
How can anybody contribute anything useful with no input?
Console log, packet trace, anything?
Nothing comes up in the console log files! Have not completed packet trace/Wireshark!
Other than to tell you that it’s NOT INTERMITTENT. Every couple of minutes, like clock work, thephone will ring. What’s noticeable is the number it seems to be coming from… 1012345, then 112345, then 122345 then 132345, etc. The numbers are incrementing by one with each call.
Try something like:
sudo tcpdump -i any -n -s 0 -w wtf.pcap port 5060 or port 5061
Let that bake for a couple of iterations and then fire up:
sngrep -I wtf.pcap
and see where these INVITEs are coming from.
Or, you can just try:
sudo tcpdump -A -i any -n -s 0 port 5060 or port 5061
and see what flys by.
thanks I’ll give the dump a try.
Any chance you have something creating ‘call files’ in
/var/spool/asterisk/outgoing/? Also take a peek at
it’s calling itself??? wtf??
Okay, I’ve gone through this. There is nothing apparent and obvious. What I can tell you is that the user agent appears to be communicating with each of the extensions. Nothing there seems to trigger the ringing. Thanks for the info, much appreciated!
Could be posible port 5060 is open on the SIP client and call is getting directly outside the PBX, but also just in case if using chan_sip disable guest calls
Nothing in this location.
No such directory.
I think the packets will yield clues. Where are the INVITEs coming from?
How about an example?
where? at the trunk level, extension, group??
/etc/asterisk/sip.conf on general settinga assuming you re using chan_sip
I don’t see anything specifically marked with “INVITE” in the sngrep of wtf.pcap. What I do see however is FROM, TO and CONTACT all from the same extension. If that helps!
ok, i’m nano and have this file open…?
In the column to the left of ‘SIP From’ is ‘Method.’ If you don’t see ‘INVITEs’ in there, you’re capturing packets from the wrong place.
sngrep will filter out dialogs that don’t contain an INVITE if you enter:
sngrep -I wtf.pcap ^INVITE
Your sngrep should look something like this:
Current Mode: Offline Dialogs: 7 Filename: pbx10.pcap Match Expression: ^INVITE BPF Filter: Display Filter: ^Idx Method SIP From SIP To Msgs Source Destination Call State [ ] 1 INVITE firstname.lastname@example.org email@example.com: 6 220.127.116.11:5060 192.168.0.31:5060 COMPLETED [ ] 2 INVITE firstname.lastname@example.org. email@example.com 11 192.168.0.139:5060 192.168.0.31:5060 CANCELLED [ ] 3 INVITE firstname.lastname@example.org email@example.com 8 192.168.0.31:5060 18.104.22.168:5060 CANCELLED [ ] 4 INVITE firstname.lastname@example.org. email@example.com 8 192.168.0.139:5060 192.168.0.31:5060 REJECTED [ ] 5 INVITE firstname.lastname@example.org email@example.com 7 192.168.0.31:5060 22.214.171.124:5060 CANCELLED [ ] 6 INVITE firstname.lastname@example.org. email@example.com 11 192.168.0.139:5060 192.168.0.31:5060 COMPLETED [ ] 7 INVITE firstname.lastname@example.org email@example.com 7 192.168.0.31:5060 126.96.36.199:5060 COMPLETED
Give me a few…Just rolling back the firmware on a wireless ip phone
nope…nothing. Should I specify localhost or the ip address in the sngrep? I’m assuming it’s monitoring the only network card on the box?
Yup…Tried that again to a “t” and nothing. the grep matchin ^INVITE displays “Current Mode: Off Line”. Sip From, Sip To, etc, and that’s it.