2Talk: Silent calls and missed calls from 'Asterisk'

Forums › VoIP › 2Talk: Silent calls and missed calls from 'Asterisk'

Skolink

1081 posts

Uber Geek
+1 received by user: 32

#78228 1-Mar-2011 19:02

Friends are on 2Talk and for ages they have been getting silent calls and the caller ID shows up as 'caller unknown' or 'out of area'. It is nearly always in the middle of the night, so they have taken to removing the batteries from their phone at night.
If they don't answer the call the phone reports missed calls from 'Asterisk'.
It seems to me it is probably 2Talk's fault? Any other ideas?
Thanks, John

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#444531 1-Mar-2011 19:05

It's just one of many hacking attempts trying SIP URI calls against VoIP devices and has nothing to do with 2talk. It's just a script trying to make calls via insecure PBX's, and because your device allows unauthenticated URI calls the phone rings.

Assuming you are using a Linksys ATA this should always have "Restrict Source IP" set to "yes", however I believe this may prevent some inbound calls on 2talk based upon what people have told me from my blog post about Linksys configurations. Full details of what this feature does are in my blog post.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#444534 1-Mar-2011 19:12

I'm guessing they also possibly have port forwarding on 5060 enabled. Removing this may prevent the issuse as most NAT firewall should only allow inbound traffic through the pinhole from the IP that the outbound request (ie SIP registration) was sent to.

Skolink

1081 posts

Uber Geek
+1 received by user: 32

#445002 2-Mar-2011 22:26

Thanks for responding. It is a Grandstream Handytone 486 (or clone) device connected directly to their cable modem, and serving as a router for a single PC. I don#t see any option for restricting the incoming caller IP address. It isn't behind a firewall obviously, but I note that "local SIP port" is set to 5060. It has the option for 'use random port', would that make any difference?
It does have the option for an "authenticate password" though.
Unfortunatelly the HT-486 doesn't seem to have uPnP either.
Thanks.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#445047 3-Mar-2011 06:14

There isn't much you can do in this case. These are a horrible quality device anyway, my recommendation would be to install a router and/or better hardware such as a Linksys SPA ATA or all in one unit such as a WRP400 or SPA521.

Just be aware that a SPA2102 or similar is no good as a router as the maximum routing speeds are ~7Mbps which is 1/2 of the speed of the cable modem connecttion.

Virgil

Dangerous Chocolate
212 posts

Master Geek
+1 received by user: 66

ID Verified

Lifetime subscriber

#445064 3-Mar-2011 08:33

Skolink: Friends are on 2Talk and for ages they have been getting silent calls and the caller ID shows up as 'caller unknown' or 'out of area'. It is nearly always in the middle of the night, so they have taken to removing the batteries from their phone at night.
If they don't answer the call the phone reports missed calls from 'Asterisk'.
It seems to me it is probably 2Talk's fault? Any other ideas?
Thanks, John

I get several of these a week also on my asterisk box - probably because I have "Allow anonymous inbound SIP calls" to Yes. If I set this to No, I lose connectivity to WXC - I understand this should not be the case, however have not managed to troubleshoot why yet

I'll answer and try to talk with them, as I figure if they have gone to so much trouble they may as well have a conversation with me :-) but no-one ever talks back.

Cheers

Lurking ...

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#445067 3-Mar-2011 08:42

Virgil:
Skolink: Friends are on 2Talk and for ages they have been getting silent calls and the caller ID shows up as 'caller unknown' or 'out of area'. It is nearly always in the middle of the night, so they have taken to removing the batteries from their phone at night.
If they don't answer the call the phone reports missed calls from 'Asterisk'.
It seems to me it is probably 2Talk's fault? Any other ideas?
Thanks, John

I get several of these a week also on my asterisk box - probably because I have "Allow anonymous inbound SIP calls" to Yes. If I set this to No, I lose connectivity to WXC - I understand this should not be the case, however have not managed to troubleshoot why yet

I'll answer and try to talk with them, as I figure if they have gone to so much trouble they may as well have a conversation with me :-) but no-one ever talks back.

Cheers

Under absolutely NO circumstances should this ever be set to Yes. The fact you need this set to yes means your trunk settings are configured incorrectly and your box is wide open to the world. If you have any insecurities in your inbound call routing it's not a matter of if, but when, your box will be hacked and used for call relaying.

The correct settings are available here in the WxC forums.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

Skolink

1081 posts

Uber Geek
+1 received by user: 32

#445090 3-Mar-2011 10:07

sbiddle: There isn't much you can do in this case. These are a horrible quality device anyway, my recommendation would be to install a router and/or better hardware such as a Linksys SPA ATA or all in one unit such as a WRP400 or SPA521.

I set the 'local port' to random, and last night there were no calls from any Gauls. Here's hoping...

sbiddle: Just be aware that a SPA2102 or similar is no good as a router as the maximum routing speeds are ~7Mbps which is 1/2 of the speed of the cable modem connecttion.

Really? I regret recommending the SPA2102 to a friend now, for use as a router and VoIP. I don't think they use their internet very heavily anyway. That might also explain why the internet is so slow at the friends' who have the HT-486. I thought maybe Wellington cable was prone to overloading in the evenings, compared to Chch. Speed tests on the '15 Mbps' connection gave a maximum of only about 4Mbps.

Will do a test tonight with and without the HT-486.

Skolink

1081 posts

Uber Geek
+1 received by user: 32

#462943 27-Apr-2011 11:26

Almost 2 months later and I'm pleased to say that the settings change did the trick. No more silent anonymous 'calls', or missed calls from 'Asterisk'.