Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Community Member

Random phone ringing constantly on UC320W system

Recently, we have been inundated with constant phone ringing. It doesn't show on our call logs. The caller ID will show name and number of 100. The weird thing is that the phone just rings and never stops ringing. Normally, the voicemail will pickup after 20 seconds, as I have it set in my setup. Busy, Unreachable, No Answer - all go to voicemail. But these calls never go to voicemail. If I wasn't there to hit the Reject button, it would ring all day. When I do answer, there is nothing on the other end. You can normally tell if someone is sitting there silent. This isn't like that. It's just a blank phone call.

The other weird thing is that the calls don't show up in my call logs. All of my other calls are in the logs - whether answered or unanswered. But the calls from 100 don't appear at all.

I was reading up on this, and a number of internet posts suggest that this may be the work of a hacker attack. It's been suggested that I limit the firewall to only allow calls to port 5060 udp from the IP of our SIP provider.  Block all other IPs to that port and to poet 5061 udp and 5060 5061 tcp, but I can't seem to find any way to do this on a UC320W.

Is this possible? The client is about to jump out of the window - with the phones all ringing constantly all day long!

Thanks for any assistance.

Gene O'Brien
Technology Service of Long Island

Everyone's tags (1)
Community Member

This is a SIP SCAN attack. 

This is a SIP SCAN attack. 

You can talk with your phone provider, but they will probably say the below.

Easiest way to stop this is to turn off SIP ALG, not sure what device you have but for me last week a 

'no ip nat service sip tcp 5060' and

'no ip nat service  sip udp 5060'

has worked a charm (after clearing the NAT table).

Good Luck! We had many calls from a non-existing 1000 number which was getting rather annoying

CreatePlease to create content