Sig 793 Keeps ringing Soft Console every 8 minutes

[techlogik]

Can't figure out what is going on. But think this is my Tie line for SIP to our Office 365 Exchange UM connection.

Running a list trace tac 793

13:01:40 Calling party trunk-group 3 member 1 cid 0x234
13:01:40 Calling Number & Name NO-CPNumber NO-CPName
13:01:40 active trunk-group 3 member 1 cid 0x234
13:01:40 dial 0
13:01:40 term attendant-group 1 cid 0x234
13:01:40 0 0 ENTERING TRACE cid 564
13:01:40 10 1 vdn e2004 bsr appl 0 strategy 1st-found override y
13:01:40 10 1 queue-to
13:01:40 10 1 LEAVING VECTOR PROCESSING cid 564
13:01:40 dial 003048413005736
13:01:40 ring attendant-group 1 cid 0x234
13:01:40 G711MU ssff ps:20
rgn:1 [10.1.1.19]:2048
rgn:1 [10.1.1.5]:2052
VOIP data from: [10.1.1.5]:2052


10.1.1.5 is the G450 on our S8300.

10.1.1.19 is the soft console, like old version of 10yrs ago..haha

Anyway, get this NO-CPNumber, then the VDN 2004 and this crazy "dial 003048413005736" shows up and the operator soft console gets a QSIG 793 on the screen.

It happens every 8 minutes like clockwork. Then when she answers, just silence, nothing.

Any help appreciated how to troubleshoot this enigma.

Thx

 

[kyle555]

get a pcap of the invite from UM. Sounds like some mailbox dialing out for something.

 

[techlogik]

IDK. Now it is some other mystery inbound that keeps trying to hit looks like the number 9 every 4 minutes.

Thought it could be the voicemail pilot, tried to replicate it but haven't been able to yet. Still don't know what/where it is coming from.

 

[kyle555]

Well, I'll tell you this: CM is pegging it to that TAC because the associated signaling group was chosen by CM, which would imply the IP/port matched on whatever that sig group likes.

Presuming you're on release 6, you can go into dom0 of th S8300 and do something like "tshark -i avpublic port 5060 -w /tmp/sipstuff.pcap" to see what that message looks like.

Maybe it's UM trying to be stupid and grab a trunk and when it gets a 200OK for establishing a session of dial tone it then outpulses digits? I dunno. It seems to have find me/follow me, call me to play messages, etc. You're probably up against something like that. Hopefully the from or pai header of that invite could clue you into who the offending user is, or, turn that fancy stuff off.