The customer reports that their phone receives calls that exhibit at least two of these symptoms:
- Display random caller ID numbers (especially 100 or 1000), weird names, or nothing.
- Ring endlessly without going to voicemail.
- Feature dead air (and possibly continue to ring) when answered.
Log into the router and set a port forward for port 5060 TCP/UDP to an unused IP that is outside the normal range
If the issue persists set the local SIP port on the phone, keep in mind if you do this for one phone it will need to be completed for the rest as the port assignments automatically change throughout the day
Ghost calls or (SIP Vicious) is caused by an external port scan of a customer’s network on port 5060. The port scan program sends an invite to port 5060 and if it gets a “hit” on this port the phone will respond by ringing. Once the response comes back the attacker will attempt to hijack the traffic on the phone to make calls.
- If you have completed all troubleshooting steps and the issue is persisting, the router will need to be replaced.
- When a router begins to fail typically the NAT will be the first thing to being experiencing issues, this can leave pinholes open through the firewall that can allow SIP Vicious traffic through to devices.
- Some routers are simply not configurable and will have no fix. One example of this would be an AT&T modem-router.