atcomsystems.ca/forum Forums TDM Business Telephone Systems Inter-Tel Telephones & Systems Inter-Tel system shutsdown randomly

Hi Everyone!

First off I would like to put it out there that I am not the administrator for our PBX. I am a member of our IT department that was tasked to figure out what it is that's going on with our phones. We have a contracted vendor, but so far he is clueless as to what the problem is.

I was able to pull the following error:

*** SIP Router: Received SIP message for non-SIP device - ID(1:'162')
404 Not Found

It is repeated several hundred times, and the phones do not come back up until I do a cold boot on the hardware. Can anyone tell me what this error is?

If you are not using SIP anywhere on your system, you should turn off the SIP listening port.

Here is a post that discusses what could possibly be happening.

https://www.sundance-communications.com/forum/ultimatebb.php?/ubb/get_topic/f/4/t/003127.html#000000

Thank you very much. I went ahead and disabled that listening port.

As I was going through the logs, I also noticed this entry right before the SIP attack occured.

-01:436- 14:14 12-08 M3008 INF EG SS [8.0.0]: Print String Response From CPC Board: HTTP login request from 85.10.136.111:43268.

I'm not aware of any mehtod of logging into the system aside from Telnet and DB studio. Is that an attempt to "break in" to our system? If it is, is there a way to shut off that access?

It probably is related although I'm not 100% positive on that. I had a customer recently that had the exact same issue with the SIP errors and I noticed that HTTP login request as well.

I'm guessing that you could change the Web listening port to be something else besides 80.

If you change it to 8080, I think you could still access it by using https:// instead of https://

Is your phone switch sitting behind a firewall, or does it have a direct internet connection?

As far as I can tell, the IP address is from a French web hosting facility.

Stix1 is on the money with the web port. You will also need to change the SIP port number from 5060 to a bogus number. Support told me yesterday it needs to be a different port number they also said to take effect it will need a reboot as well.
Randy

The phone switch is behind a firewall. For now I've just disabled all inbound HTTP traffic to IP assigned to the phone. I'll just have to monitor the logs to see if there are any other unusual login attempts.

Thanks again everyone for the help. I'm totally new to the PBX world, but I must say it's been fun so far.