Showing results for 
Search instead for 
Did you mean: 

Logs filling up with... created auto attendant "Auto attendant"

Nicholas Holum

Working with MCU 4510 this morning, I noticed a new conference called "auto attendant"

DescriptionOwnerRegistrationParticipantsStart timeTime remaining
redacted ConferenceMeredacted


Registered0Mar 22 2013, 12:42<forever>
Auto attendant
<auto attendant><none>n/a110:44<forever>
Auto attendant 1
<auto attendant><none>n/a110:44<forever>



Registered0Aug 9 2013, 14:10<forever>

Here is a snapshot of the logs. I do not recognize any of the external IP addresses.

21985700:32:49.377 H.323InfoNew connection accepted from
21985800:32:49.379 CONFERENCEInfonew H.323 participant 4218
21985900:32:49.473 CONFERENCEInfocreated auto attendant "Auto attendant"
21986000:33:53.729 CONFERENCEInfodestroy H.323 participant 4218, "442099999999@"
21986100:33:53.731 CONFERENCEInfodestroyed "Auto attendant"
21986200:37:32.613 H.323InfoNew connection accepted from
21986300:37:32.614 CONFERENCEInfonew H.323 participant 4219
21986400:37:32.697 CONFERENCEInfocreated auto attendant "Auto attendant"
21986500:38:36.738 CONFERENCEInfodestroy H.323 participant 4219, "442099999999@"
21986600:38:36.740 CONFERENCEInfodestroyed "Auto attendant"
21986700:41:14.240 H.323InfoNew connection accepted from
21986800:41:14.241 CONFERENCEInfonew H.323 participant 4220
21986900:41:14.324 CONFERENCEInfocreated auto attendant "Auto attendant"
21987000:42:18.575 CONFERENCEInfodestroy H.323 participant 4220, "442099999999@"
21987100:42:18.577 CONFERENCEInfodestroyed "Auto attendant"
21987200:46:16.970 H.323InfoNew connection accepted from
21987300:46:16.971 CONFERENCEInfonew H.323 participant 4221
21987400:46:17.056 CONFERENCEInfocreated auto attendant "Auto attendant"
21987500:46:23.341 H.323InfoNew connection accepted from
21987600:46:23.342 CONFERENCEInfonew H.323 participant 4222
21987700:46:23.427 CONFERENCEInfocreated auto attendant "Auto attendant 1"
21987800:47:21.302 CONFERENCEInfodestroy H.323 participant 4221, "442099999999@"
21987900:47:21.304 CONFERENCEInfodestroyed "Auto attendant"
21988000:47:27.491 CONFERENCEInfodestroy H.323 participant 4222, "442099999999@"
21988100:47:27.493 CONFERENCEInfodestroyed "Auto attendant 1"
21988200:47:49.072 H.323InfoNew connection accepted from
21988300:47:49.073 CONFERENCEInfonew H.323 participant 4223

Is this some kind of malicious attack?

7 Replies 7

Patrick Pettit
Cisco Employee
Cisco Employee

HI Nicholas.  To me, it seems the VCS may be sending the call towards your MCU and these calls may be originating from your Expressway perhaps? 

Looks like someone is trying to send calls your way to try and gain access to an ISDN Gateway that may be on your network, but calls are routing to your MCU instead.  MCU may be setup to send calls to Auto Attendant under

Incoming calls to unknown conferences or auto attendants. 

If you have an ISDN Gateway on your network, look at the VCS admin guide to try and restrict these types of calls getting to your GW.



To add to PP's response, do you have your VCS setup with a fallback alias, and if so, is it your MCU?

On another note, is your MCU open to the public, and is SIP enabled? Calls could be trying to go to the MCU directly if it's open to the public.

Sent from Cisco Technical Support iPhone App


I checked VCS and it is not configured for fallback alias.

Also, MCU is not open to the public directly. We have VCS-E though.

I'd check the VCS that the MCU is registered to, looking at the search history going to your MCU for these calls and make your backward to the source, ie your Expressway, or a trunk to something else on your network, etc.

Sent from Cisco Technical Support iPhone App

Thanks for the response Patrick,

We do not have any ISDN Gateways on our network. However, I have informed our voice admin of the situation and he mentioned it could be a trunk doing something. He's investigating on his end.

Steve Kapinos
Cisco Employee
Cisco Employee

This is 'new age wardialing'

People scan telephone systems and gateways looking for systems they can 'hairpin' through.  Basically send a request in via a local or 'free' connection, and then get redirected out a gateway or trunk to a toll destination  (like calling overseas)

You can look at the history in your VCS for how the call got directed to the MCU..  Follow it backwards and inspect your call routing rules.

Receive this from my 3rd party support...

Below is a good thread that kind of outlines the issues you’re having.  Basically a new rule needs to be added over to your VCS in order to stop the spamming. You’ll go to VCS configuration

New rule for VCS.PNG

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: