Phantom Overnight Calls

jshdcooper · ‎01-30-2015

I've got a peculiar issue. A client is reporting that their phone system is calling random people at all hours of the night. I ran a debug isdn q931, and sure enough, found where those numbers are being called. There is some strange output from the debug, I was hoping someone here might be able to help shed some light on.

Here is some pertinent debug information. Interesting, those H323 debugs come in with an incorrect timestamp, and I don't see them ever during business hours when there are no inappropriate calls reported. We do not have an H323 gateway.

059129: Jan 30 02:07:50.240: ISDN Se0/0/0:23 Q931: RX <- PROGRESS pd = 8  callref = 0x9168
        Progress Ind i = 0x8188 - In-band info or appropriate now available
059130: Jan 30 07:08:04.316: %VOICE_IEC-3-GW: H323: Internal Error (Socket error): IEC=1.1.186.5.7.6 on callID 4530                                                                                                                          7 GUID=3ADF16EA46C31D263BC161799CEC4C2C
059131: Jan 30 02:08:04.340: ISDN Se0/0/0:23 Q931: TX -> DISCONNECT pd = 8  callref = 0x1168
        Cause i = 0x80A6 - Network out of order
059132: Jan 30 02:08:04.352: ISDN Se0/0/0:23 Q931: RX <- RELEASE pd = 8  callref = 0x9168
        Cause i = 0x82E4 - Invalid information element contents
059133: Jan 30 02:08:04.352: ISDN Se0/0/0:23 Q931: TX -> RELEASE_COMP pd = 8  callref = 0x1168
059134: Jan 30 02:14:44.994: ISDN Se0/0/0:23 Q931: pak_private_number: Invalid type/plan 0x0 0x1 may be overriden;                                                                                                                           sw-type 13
059135: Jan 30 02:14:44.994: ISDN Se0/0/0:23 Q931: Sending SETUP  callref = 0x1169 callID = 0x90EA switch = primary                                                                                                                          -ni interface = User
059136: Jan 30 02:14:44.994: ISDN Se0/0/0:23 Q931: TX -> SETUP pd = 8  callref = 0x1169
        Bearer Capability i = 0x8090A2
                Standard = CCITT
                Transfer Capability = Speech
                Transfer Mode = Circuit
                Transfer Rate = 64 kbit/s
        Channel ID i = 0xA98395
                Exclusive, Channel 21
        Called Party Number i = 0xC1, 'xxxxxxx'
                Plan:ISDN, Type:Subscriber(local)
059137: Jan 30 02:14:45.042: ISDN Se0/0/0:23 Q931: RX <- CALL_PROC pd = 8  callref = 0x9169
        Channel ID i = 0xA98395
                Exclusive, Channel 21
059138: Jan 30 02:14:48.086: ISDN Se0/0/0:23 Q931: RX <- PROGRESS pd = 8  callref = 0x9169
        Progress Ind i = 0x8188 - In-band info or appropriate now available
059139: Jan 30 07:15:14.970: %VOICE_IEC-3-GW: H323: Internal Error (Socket error): IEC=1.1.186.5.7.6 on callID 4530                                                                                                                          9 GUID=FED5663502C711A11DE9F9581075D0FF
059140: Jan 30 02:15:14.986: ISDN Se0/0/0:23 Q931: TX -> DISCONNECT pd = 8  callref = 0x1169
        Cause i = 0x80A6 - Network out of order
059141: Jan 30 02:15:14.998: ISDN Se0/0/0:23 Q931: RX <- RELEASE pd = 8  callref = 0x9169
        Cause i = 0x82E4 - Invalid information element contents
059142: Jan 30 02:15:14.998: ISDN Se0/0/0:23 Q931: TX -> RELEASE_COMP pd = 8  callref = 0x1169

deepaul · ‎01-31-2015

Hi,

Is this a contact center environment ?

I would say that you check if they have any Callback option or outbound dialing mechanism in the system.

regards,

Deepu

EmilTaghiyev · ‎01-31-2015

Could You be pleased to describe VOIP system configuration?

jshdcooper · ‎02-01-2015

It is not a contact center. It is a fairly straight forward CME environment. Using CUE for auto attendant and exchange for voicemail.

jshdcooper · ‎02-01-2015

I set up a translation for one of the numbers being reportedly phantom called to redirect to my cell and got a call this morning at 3am.

The translation pattern is applied to

dial-peer voice 3 pots
 description ** T1 PRI pots dial-peer **
 translation-profile outgoing outbound_caller_id
 preference 3
 destination-pattern 9[2-9]......
 port 0/0/0:23