Video Conferences listed in TMS Monitoring and MCU with Ad Hoc in title that were not scheduled by us.

[cnorris@thompsoncoburn.com]

After a year working with TMS and a Codian MCU I am just now starting to find active connections that I did not schedule. I was seeing the "Video Conference" in TMS Monitoring as well as the MCU. At first I just disconnected the mystery participant in the MCU. After the network guy blocked the IP and eventually the port these connections are now one minute long each. They still appear in TMS under monitoring titled "Ad Hoc: 123456789"with Owner "network service" or similar. Can I stop this? Is this the nature of a public IP? Some days there are none and some days there are 20. 

[Patrick Sparkman · Accepted solution]

Sounds as if your MCU is on a public IP address, if so, these calls are most likely toll-fraud attempts, happens with any publicly accessible H323/SIP device on the internet.  You could restrict access to your MCU and only allowing known IP addresses you want to video conference with, you could put an VCS or Expressway-C/E in front of your MCU and restrict access with search rules and/or call policy rules.

I've never used it, but depending how you use your MCU, you could enable port reservation, which can prevent ad hoc conferences from being created, and restrict conferences to only be created by the built-in scheduler of the MCU or TMS.

If you want TMS to stop monitoring for ad hoc conferences, you can disable Enable Ad Hoc Conference Monitoring under Admin Tools > Configuration > Network Settings.

[cnorris@thompsoncoburn.com]

Thanks for the insights Patrick. If I am understanding you correctly it is just the nature of using a public IP and more of an annoyance than a security issue? I assume that ad hoc meetings are being allowed in TMS because it must be easier on coordination efforts specifically with outside connections.   

[Patrick Sparkman]

Toll-fraud attempts is a side affect of putting an H323/SIP device on the public internet, once it's scanned and the calls start, it can get very annoying fast. So much so, our VCS gets hit by hundreds of attempts each day, so we use CPL rules to block the calls. It can lead to issues, for example, if you had a route from your MCU to a PSTN gateway, it could be possible that the calls could just happen to match that route and then make a call out via the PSTN, end result would be you get charged for that call.
If you have TMS set to monitor ad hoc conferences, than they will all appear in TMS as they happen, which depending on the number of toll-fraud calls and ad hoc conferences being created, could overwhelm your ability to monitor conferences in CCC. If you don't do any ad hoc conferencing, and all conferences are scheduled in TMS in advance, I'd try the MCU port reservation mode which can prevent them from being created, or if you need to have ad hoc conferences, simply disable the monitoring of them.