Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Receiving IP calls from within local network. Please help

Hello,

First time poster, but I couldn't find a similar thread.

My C60 telepresence codec is receiving calls constantly every 30 seconds to a minute from within my local network.  The incoming call alert says it's coming from an IP address within our local range: 10.10.10.XXX, and for each incoming call, the last 3 digits of the IP address is different (10.10.10.15, then 10.10.10.25, then 10.10.10.700, etc).  If I leave it alone for a week, I will come back to over 1,000 missed calls and the machine is frozen.  Often it will be frozen each time I wake it up and I have to restart it.  I haven't changed the configuration at all since it was last working fine.

I contacted my ISDN gateway service provider first and disconnected from their services to troubleshoot, but the calls were still coming in.  I just unplugged the Cat6 cable to see if it's happening from within the codec itself.  The calls stopped coming in and the box is responsive again.

Something within my local network is calling the box via IP address.  Have any of you heard of or seen this happening before?  Any advice?

Thanks in advance,

-Rory

  • TelePresence
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Green

Re: Receiving IP calls from within local network. Please help

Hi Rory,

Definately looks like a SIPVicious (or similar) probe.  These have been mentioned many times in the forums before.

One thing you can try on your endpoint is to set "xConfiguration SIP ListenPort: Off".

See Bug CSCue55239 as well - you may want to upgrade the firmware on your device too.

PS - You may also be interested in this Security Advisory if you don't have a service contract - it'll help you upgrade to at least TC6.1 if you're on an older software version on your C60.

Wayne

--

Please remember to rate resposnes and to mark your quesiton as answered if appropriate.

10 REPLIES
VIP Purple

Re: Receiving IP calls from within local network. Please help

Hello Rory -

Can you tell us something more about your network and how the codec is setup.

  • Is the codec open to the public internet?
  • What call protocol do you see these incoming calls on, H323/SIP/ISDN?
  • Is there a VCS in the mix, or other codecs on the network?

As much detail as possible is always best.

VIP Green

Receiving IP calls from within local network. Please help

Hi Rory,

This sounds very much like a SIPVicious (or similar) scan.

As Patrick has asked above, can you please let us know a bit more about your environment, protocols and infrormation from any logs (ie, VCS and/or endpoint call logs showing these calls)?

Wayne

--

Please remember to rate responses and to mark your quesion as answered if appropriate.

New Member

Receiving IP calls from within local network. Please help

Thanks for replying.

I just went back and looked at the missed calls and I am badly mistaken (too much going on at work today...).

The calls ARE NOT coming from our local IP range; they are coming from our public static IP address that points to the codec.  The caller looks like this #####@00.00.00.00 (masked public IP), where the digits before @ change each time, sometimes in patterns sometimes not.  One set of missed calls shows: 10@..., then 100@..., then 1000@..., then 10000@....

I leave auto-answer off generally, but when left on, the incoming calls do not fully connect.  They attempt to connect, then time out after 5-10 seconds.  I've had these calls come in during live sessions before, so I now have to enable "Do not disturb" every time I'm connected with someone.

Yes, the codec is open to the public internet.

I don't see the protocol when they come in, but I haven't setup SIP and don't have ISDN ports.  I use only H323.

No VCS and no other codecs on the network.

I'm trying to figure out what could be calling our codec from our public IP and why would it have a different address each time.  Our ISDN gateway service gave up and my network engineer directed me here to see if anyone else has seen this.

VIP Green

Re: Receiving IP calls from within local network. Please help

Hi Rory,

Definately looks like a SIPVicious (or similar) probe.  These have been mentioned many times in the forums before.

One thing you can try on your endpoint is to set "xConfiguration SIP ListenPort: Off".

See Bug CSCue55239 as well - you may want to upgrade the firmware on your device too.

PS - You may also be interested in this Security Advisory if you don't have a service contract - it'll help you upgrade to at least TC6.1 if you're on an older software version on your C60.

Wayne

--

Please remember to rate resposnes and to mark your quesiton as answered if appropriate.

Receiving IP calls from within local network. Please help

I don't see the protocol when they come in, but I haven't setup SIP and don't have ISDN ports.  I use only H323.

Make sure SIP is actually turned off under "Network Services".

/jens

Please rate replies and mark question(s) as "answered" if applicable.

Please rate replies and mark question(s) as "answered" if applicable.
VIP Purple

Re: Receiving IP calls from within local network. Please help

Wayne, you're too fast for me lol.  I was typing a reply when I got an email with yours. 

It's what I was leaning towards as well, most comnly when it looks like the codec is calling itself, it's usually that.  There are ways you can find the protocol being used, if it's SIP or not.  You can log into the codec using SSH and run xHistory CallLogs Call and sift through there and find the incoming calls.  There are other ways too, but that one comes to mind, I do more with the CLI than anything, so it's usually what I go to first.

For an example of the xHistory command, you can take a look at my discussion here, which had the same issue as you.  It also recommends the same codec setting that Wayne does above.

https://supportforums.cisco.com/message/4050149#4050149

New Member

Receiving IP calls from within local network. Please help

Thanks to you all! I turned SIP off and also downloaded the newest patch for TC4.x.  I don't have a service contract, but I was able to download and install version 4.2.4 (from 4.2.2) from the Cisco site without a release key (http://software.cisco.com/download/release.html?mdfid=283688217&catid=280789323&flowid=46178&softwareid=280886992&release=TC4.2.4&rellifecycle=&relind=AVAILABLE&reltype=latest
). 

I watched it all day today after I made these changes and the issue seems to have been resolved.

Thanks again for the help and quick responses!

-Rory

VIP Green

Re: Receiving IP calls from within local network. Please help

Thanks for the update Rory.  Great to hear you've fixed your problem.

You may still want to consider that Security Advisory I linked previously, and the "free" upgrade to TC6.1 that it'll enable you to get (especially without having an active service contract), to address those security problems if your device is accessible from the Internet.

That'll help to get you deivce up to a more recent release, although will not guarantee any future upgrades - you will need a service contract for those.

Wayne

--

Please remember to rate responses and to mark your question as answered if appropriate.

New Member

Receiving IP calls from within local network. Please help

I tried that. I navigated to the download site from the link you sent me and installed 6.1, but after the install, the codec wouldn't function without a new release key. I went back to the site and reverted to 4.2.4 and it's working fine with my existing key.

Am I missing something?

845
Views
29
Helpful
10
Replies
This widget could not be displayed.