Repeated calls from one phone to another

[cis-admins]

I am using Cisco unified call manager 11.5 and I have a instance where one phone number is repeatedly trying to call another phone number in rapid succession. One of the numbers is a CTI group and the number being called is one that used to exist but was removed from the system quite some time ago

[Jaime Valencia]

Look at the CUCM traces to find out the call flow and then find out who is dialing.

[cis-admins]

How do you run a trace? I did use the DNA but it didn't tell me much 

[Jonathan Schulenberg]

Probably a stuck Redial softkey. Anyway, if you aren’t familiar with even pulling SDL traces through RTMT it’s unlikely that you will know how to read them. I suggest opening a TAC case for assistance here.

[cis-admins]

I am trying to open a call with TAC, but if anyone has any instructions on how to run a SDL trace I think I could learn how to do it

[HARIS_HUSSAIN]

1) You can use below link to download translator and parse the log using it

https://community.cisco.com/t5/collaboration-voice-and-video/trace-reading-with-translatorx/ta-p/3165178

*** Please rate helpful post; Mark "Accept as a Solution" if applicable

Thanks,
Haris

[cis-admins]

I found this vulnerability listed on my firewall "sip invite method request flood attempt" which I will block with the firewall but I am not sure how it is getting the internal numbers to call out. Any ideas?

[Mohammed al Baqari]

Hi,

What is using the CTI port for the calling number. Check that application to see why its initiating calls. Also, is the called number registered to CUCM or is it reachable through a trunk/gateway. You might be having unreachable number which is routed back to CUCM then routed over the trunk again which is going in a routing loop.

[cis-admins]

I am knew to phones how can I tell what CTI port? Check what application to make sure what is initiating calls. The first one instance looked liked it was calling from a registered phone to another registered phone, but the called phone, the second time was from an external unregistered phone  to an internal registered phone. It looks like some kind of Dos attack.