I was getting hundreds of ghost calls every day on hundreds of endpoints. This fix did the trick. Question: We are still using the H.323 standard but does anyone know if turning off the SIP listenport will not allow SIP calls directly to the codec? Do they need to go through VCS from now on?