12-10-2014 03:50 AM - edited 03-18-2019 03:46 AM
We have a MX200 that sits outside of our firewall so outside parties can call the MX200. This is a new system and ever since I first installed it, I've noticed that after a day or two, I saw lots of missed incoming calls in the call log. I don't know if they're real calls or not. There shouldn't be anyone calling this system because I haven't given out the IP to anyone yet and it's mostly just for testing for the time being. So, the many missed calls in the call log seems odd and suspicious to me. I can never see an IP address of who or what is supposedly calling in to our MX200. All I can see is what looks like an extension number like 300 or 1000 or something like that, followed by our own IP address. I had assumed there would be a way to see what the far end's IP address was for anyone that call into our unit, but I guess that's not really true? Is there some way I can find the IP address of whatever is attempting to connect to our MX200?
See attached screenshots for examples. There are multiple entries for each ID. For example, 4 missed recent calls from the ID of '300'. If I look at that particular entry, it only shows me 300 @ our IP address. Does that mean something is trying to reach 300 @ our IP or does that mean the ID of the far end is 300 and they called our IP? I see no other IP listed in any of these missed calls other than our own IP.
Any ideas? Should I be suspicious about this activity? Any way to determine what IP is actually trying to call in/connect to our MX200? At the very least, this would be very annoying even if it's not truly suspicious activity because if I put this unit in a conference room and suddenly the screensaver turns off and the bright blue screen comes on and there's a call ringing in, that would disturb and confuse anyone that happens to be in that room for a meeting. I turned off auto answer so there's no danger of the calls automatically connecting and someone being able to move the camera around and view the surroundings, but nonetheless, I think this constant 'missed call' activity is strange and suspicious.
Any IP you see hidden in my screenshots is our own IP and I blocked it out for posting on the web here.
Thanks
Solved! Go to Solution.
12-10-2014 04:56 AM
You don't say if these are SIP or H.323 calls, but regardless of that, it does fit in with the scans we have all seen, and still see, and which have been mentioned in this forum a number of times, take a look at
https://supportforums.cisco.com/discussion/12366101/unknown-cisco-incoming-calls for starters.
/jens
Please rate replies and mark questions as "answered" if applicable.
12-10-2014 04:56 AM
You don't say if these are SIP or H.323 calls, but regardless of that, it does fit in with the scans we have all seen, and still see, and which have been mentioned in this forum a number of times, take a look at
https://supportforums.cisco.com/discussion/12366101/unknown-cisco-incoming-calls for starters.
/jens
Please rate replies and mark questions as "answered" if applicable.
12-10-2014 04:58 AM
They all appear to be SIP calls.
Thanks, I'll look at that discussion.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide