Hi, we have an Asterisk (Trixbox) implementation that was workign perfectly, up until a few weeks when users started complaining that internet browsing is slow.
The PBX is connected with TWO NICs: one one SIP modem (which seems OK), the other on our hardware firewall (for management purposes). After hours of troubleshooting, we have discovered that the PBX was the culprit, as it is sending data constantly down the ADSL link. It maxes out the upload bandwidth of the ADSL connection, sending data with 5060 source port (SIP traffic?) to two UNKNOWN destinations, one in UK, one in China.
We have blocked this on the firewall, but we can see it still attempting to send traffic, every single second.
Any ideas as to WHAT this traffic is?