cancel
Showing results for 
Search instead for 
Did you mean: 

Bizarre incoming calls - from IP 10*0*1*199

Community Veteran
Posts: 6,263
Thanks: 433
Fixes: 40
Registered: 30-07-2007

Bizarre incoming calls - from IP 10*0*1*199

Anyone on here seen these strange calls, seems to be mainly (but not exclusively) Gigaset base units according to the whirlpool forum thread http://forums.whirlpool.net.au/archive/2443317 . My C475IP started getting them Mon evening , got the first one about 20:00 and then one around midnight. It started again about 4:30 Tues monring, and I got one about every 2 mins for about 1 hour. It got really annoying, so I logged into the phone and disabled both voip accounts ( PN & LocalPhone ), made no difference. Seemed to be ok during the day yesterday. I checked all router settings last night and there are No port forwards so I really don't see how anything is getting to the phone.
Anyway it seemed like it had stopped but then last night I got another one at 20:25! At that point I unplugged the network from the C475 , that fixed it for overnight! Let's see how it goes today now it's connected again.
The whirlpool thread seems to be tending towards a Gigaset (or similar chipset) issue. It does seem stange that a high percentage of people reporting the problem have Gigaset base units, there's got to be plenty more different voip units out there, why are they not affected? Maybe those people don't frequent the same forums ?
I'm going to trawl through router logs tonight and see if there's anything useful there, and alos have a look at the G475 config again is respect of Info Services ...
8 REPLIES
Community Veteran
Posts: 6,535
Thanks: 188
Fixes: 13
Registered: 16-02-2009

Re: Bizarre incoming calls - from IP 10*0*1*199

Strange a 10.x ip is a private network, shouldn't be routable outside the lan.
Wonder if the base has a 10.x network hardwired in ? Then you could use the mac address to send to it, assuming all the base units share a similar base mac.
Given you have disabled the voip providers then it must be lower level comms, like M$ used to use e.g. netbui. Or numberless ip, seem to vaguely remember something about that from ~10 years ago.
Community Veteran
Posts: 6,263
Thanks: 433
Fixes: 40
Registered: 30-07-2007

Re: Bizarre incoming calls - from IP 10*0*1*199

Quote
Strange a 10.x ip is a private network, shouldn't be routable outside the lan.
Yes, that can't possibly be the originating IP, as you say, it's not routable outside the LAN. It's probably the IP from the SIP header. I can't quite see how anything originating outside the LAN is going to get through the router to reach the phone. As far as I can see, only an outgoing connection  from the phone is going to open a NAT session to allow traffic to the phone!. I've posted on the whirlpool forum as well now.
HartPD
Newbie
Posts: 9
Registered: 31-07-2007

Re: Bizarre incoming calls - from IP 10*0*1*199

I also received a call from that IP address 10*0*1*199,  I tried to answer, but line was dead. Call log just says online direct call from Plusnet Phone # 1
I ignored it, but interested to see someone else observing the same thing.
Using Gigaset NP300 and 4 x SL400 handsets,

Paul.
between1and16ch
Grafter
Posts: 113
Thanks: 1
Registered: 24-09-2008

Re: Bizarre incoming calls - from IP 10*0*1*199

Same here - same IP address around the same times - on a C475IP Gigaset base station
Community Veteran
Posts: 4,678
Thanks: 1,010
Fixes: 27
Registered: 16-10-2014

Re: Bizarre incoming calls - from IP 10*0*1*199

Could it be someone probing Plusnet's VoIP servers, looking for exploits?
Our logs show frequent attempts by script kiddies trying to exploit the system to steal call time.
Community Veteran
Posts: 6,263
Thanks: 433
Fixes: 40
Registered: 30-07-2007

Re: Bizarre incoming calls - from IP 10*0*1*199

Quote
Could it be someone probing Plusnet's VoIP servers, looking for exploits?
No, it's not coming from the voip servers. It seems to be a direct IP call to the phone. The IP address reported on the phone is not the sending IP, it's a spoofed one from the SIP packet. What I, and others don't understand is how it's getting to the phone!. Only SIP packets from the voip providers systems should be getting through a router firewall, these are coming from somewhere else. ShieldsUp shows my router completely stealthed which is what I would expect, so unless the phone itself is opening a connection to somewhere, which would then allow data through the router firewall from that address, then I can't see how the packet is arriving. 
between1and16ch
Grafter
Posts: 113
Thanks: 1
Registered: 24-09-2008

Re: Bizarre incoming calls - from IP 10*0*1*199

This, if true, is intriguing.
http://www.ip-phone-forum.de/showthread.php?t=280915&page=4&p=2113541&viewfull=1#post2113541
A forum post allegedly quoting a Gigaset Customer service agent saying basically 'we are aware of the situation and are investigating'
Community Veteran
Posts: 6,263
Thanks: 433
Fixes: 40
Registered: 30-07-2007

Re: Bizarre incoming calls - from IP 10*0*1*199

I had another look last night at trying to stop these calls. I had already set my C475IP to use 'random ports' and that didn't seem to stop the calls. I didn't really expect it to, since I had already confirmed with 'shields up' that there were no ports open. My router firewall shows that the ONLY traffic allowed to the phone is from the IP of the voip server it's registered to.
So I turned my attention to possible opening of a connection FROM the phone. It seems to be common knowledge that it contacts gigaset regularly. Now my phone has gigaset.net disabled, updates disabled and info services disabled so why would it be contacting anyone ?. Then I found the Messaging facility! you can't seem to turn that off. It appears to be a Jabber instant messaging and the url set in the phone is jabber.gigaset.net. Anyway my router has a clever facility which allows you to set items in it's DNS cache, so I set jabber.gigaset.net to a non accessible IP ( 10.0.0.0 ). Just for good measure I also set gigaset.net to 10.0.0.0 as well. Now it may be coincidence BUT So far no more phantom rings...