Skip to main content
Ghost Calls: Troubleshooting
8x8 Support Knowledge Base

Ghost Calls: Troubleshooting

Symptom

The customer reports that their phone receives calls that exhibit at least two of these symptoms:

  • Display random caller ID numbers (especially 100 or 1000), weird names, or nothing.
  • Ring endlessly without going to voicemail.
  • Feature dead air (and possibly continue to ring) when answered.

Applies To

Desk phones

Resolution

 Log into the router and set a port forward for port 5060 TCP/UDP to an unused IP that is outside the normal range

If the issue persists set the local SIP port on the phone, keep in mind if you do this for one phone it will need to be completed for the rest as the port assignments automatically change throughout the day

Cause

Ghost calls or (SIP Vicious) is caused by an external port scan of a customer’s network on port 5060. The port scan program sends an invite to port 5060 and if it gets a “hit” on this port the phone will respond by ringing. Once the response comes back the attacker will attempt to hijack the traffic on the phone to make calls.

Additional Information

  • If you have completed all troubleshooting steps and the issue is persisting, the router will need to be replaced.
  • When a router begins to fail typically the NAT will be the first thing to being experiencing issues, this can leave pinholes open through the firewall that can allow SIP Vicious traffic through to devices.
  • Some routers are simply not configurable and will have no fix. One example of this would be an AT&T modem-router.

 

 

  • Was this article helpful?