cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
644
Views
0
Helpful
2
Replies

MX200 recieving mystery calls

voip7372
Level 4
Level 4

We have a MX200 that sits outside of our firewall so outside parties can call the MX200.  This is a new system and ever since I first installed it, I've noticed that after a day or two, I saw lots of missed incoming calls in the call log.  I don't know if they're real calls or not.  There shouldn't be anyone calling this system because I haven't given out the IP to anyone yet and it's mostly just for testing for the time being.  So, the many missed calls in the call log seems odd and suspicious to me.  I can never see an IP address of who or what is supposedly calling in to our MX200.  All I can see is what looks like an extension number like 300 or 1000 or something like that, followed by our own IP address.  I had assumed there would be a way to see what the far end's IP address was for anyone that call into our unit, but I guess that's not really true?  Is there some way I can find the IP address of whatever is attempting to connect to our MX200?  

See attached screenshots for examples.  There are multiple entries for each ID.  For example, 4 missed recent calls from the ID of '300'.  If I look at that particular entry, it only shows me 300 @ our IP address.  Does that mean something is trying to reach 300 @ our IP or does that mean the ID of the far end is 300 and they called our IP?   I see no other IP listed in any of these missed calls other than our own IP.

Any ideas?  Should I be suspicious about this activity?  Any way to determine what IP is actually trying to call in/connect to our MX200?  At the very least, this would be very annoying even if it's not truly suspicious activity because if I put this unit in a conference room and suddenly the screensaver turns off and the bright blue screen comes on and there's a call ringing in, that would disturb and confuse anyone that happens to be in that room for a meeting.  I turned off auto answer so there's no danger of the calls automatically connecting and someone being able to move the camera around and view the surroundings, but nonetheless, I think this constant 'missed call' activity is strange and suspicious.  

Any IP you see hidden in my screenshots is our own IP and I blocked it out for posting on the web here.

Thanks 

1 Accepted Solution

Accepted Solutions

Jens Didriksen
Level 9
Level 9

You don't say if these are SIP or H.323 calls, but regardless of that, it does fit in with the scans we have all seen, and still see, and which have been mentioned in this forum a number of times, take a look at

https://supportforums.cisco.com/discussion/12366101/unknown-cisco-incoming-calls for starters.

/jens

Please rate replies and mark questions as "answered" if applicable. 

Please rate replies and mark question(s) as "answered" if applicable.

View solution in original post

2 Replies 2

Jens Didriksen
Level 9
Level 9

You don't say if these are SIP or H.323 calls, but regardless of that, it does fit in with the scans we have all seen, and still see, and which have been mentioned in this forum a number of times, take a look at

https://supportforums.cisco.com/discussion/12366101/unknown-cisco-incoming-calls for starters.

/jens

Please rate replies and mark questions as "answered" if applicable. 

Please rate replies and mark question(s) as "answered" if applicable.

They all appear to be SIP calls.  

Thanks, I'll look at that discussion.