unknown incoming calls on codecs (sx20 & c40)

[techguy]

Hi peeps, I have codecs registered in VCS control. I am receiving unknown incoming sip calls on all codecs. Sip listen port is off on sx20 and couldn't find it on c40 but still receiving. Receiving address is like any number@ip address of codec. 123@10.1.208.1 where codec ip is 10.1.208.1

[Jens Didriksen]

Do you have a VCS-C and VCS-E, or just the VCS-C? If just the VCS-C, how is this deployed?

You should be able to block these calls by using CPL, however, when you say "receiving address", do you mean "source address", as in where the call is coming from, or "destination", as in address being called?

/jens

Please rate replies and mark question(s) as "answered" if applicable.

[Patrick Sparkman]

You should be able to find SIP ListenPort on the C40, the setting is in the same location as the SX20.  If you can't find SIP ListenPort on the C40, what software version is it running?

I suspect that even though you have a VCS control and your endpoints are registered to it, I presume your endpoints have a public IP that accessible from the outside?  It can explain why you're seeing the type of calls you are, as numbers@endpoint_ip is typical in that scenario.  The endpoints are being scanned from the outside and external parties are trying to make toll fraud calls through them, see CSCue55239 for more details.  The firewall should closed for all your endpoints IPs, and have the VCS be the single entry/exit point for all video conference traffic.  Also, turning off SIP UDP on the VCS is recommended as well, as the VCS is prone to this same thing with UDP enabled.