sundance-communications.com/forum Forums TDM Business Telephone Systems Inter-Tel Telephones & Systems VPU phone home

We have an Axxess system which we were subleasing from another company which was leasing it from Inter-tel. We purchased the system at the end of the lease term.

I recently discovered that the VPU is contacting several IP addresses belonging to the other company hundreds of times a day. I asked the contact I had at the other company and he said he didn't know what it was doing and I should contact Mitel.

Any idea what it might be doing?

It could have a virus. We had a VPU on the open internet for ten minutes (a test) and in that amount of time it sent itself up as an email bot and was sending out thousands of emails.

"I recently discovered that the VPU is contacting several IP addresses belonging to the other company hundreds of times a day."

If it is contact specific IP addresses for the other company, it's not a virus. It has been programmed. Have you run a sniffer on it to see what is being transmitted? Does your VPU have a WAN address associated with it? The other company's CTI Gateway may be communicating with your VPU.

I don't think it's a virus. It is contacting specific addresses at the former owner company. The system has an IP address of 10.1.0.118:3707 which is a private IP, but not one of mine. I tried my contact at the other company but he said he didn't know what it was doing. There's also a username and pwd associated with this IP address. I know that the former company had all of their systems centrally managed.

It could be that their CTGateway device is the one initiating the communication. A single CTGateway connects OAI information for all systems. If they are using a CTGateway, a connection has been programmed. They will need to delete it.

Some of their own systems may be trying to connect directly. Or your system may still be programmed to connect to theirs. Look in System\Devices and Feature Codes\Node IP Connection Groups and in System\Devices and Feature Codes\Nodes. Are other systems programmed? If your system is now a stand alone, you can delete the non local systems.

:confused:
System > Devices and Feature Codes > IP Connections is empty.

System > Devices and Feature Codes > IP Ports
Extension - PP170
Description - CPC IP Port 1
Address - 08:08.06.01

System > Devices and Feature Codes > IP Ports > PP170
Current IP Address - 192.168.xxx.xxx
Current Subnet Mask - 255.255.255.0
Current Gateway - 10.31.53.1 (not my gateway)
Current WINS Server - 0.0.0.0
Static IP Address - 192.168.xxx.xxx
Static Subnet Mask - 255.255.255.0
Static Gateway - 10.31.53.1 (not my gateway)
Static WINS Server - 0.0.0.0
Hostname -
IP Address Assignment: BOOTP - No
IP Address Assignment: DHCP - No
Telnet Server - Yes
Web Server - Yes
Listening Port 4000
Web Listening Port - 80

System > Devices and Feature Codes > Network Groups
Extension - PP029
Description - Default Network GRP
Username -
Use P2P Audio - No

System > Devices and Feature Codes > Network Groups > PP029
All blank

System > Devices and Feature Codes > Nodes
Node - Local
Description - CO Springs
Username - xxxxxxxxxx
Node Number - 8

I'm afraid I'll delete something and break it.