- 15 September 2016
- Erik Brokkaar
At the gnTel support department, we regularly receive queries from users who keep getting â€˜ghost calls,â€™ typically several times in a row. Such calls have a unconventional and invalid sender number (frequently 100, 101 or 1000) and when one picks up, thereâ€™s no one at the other end. Because they sometimes keep calling for hours on end, this can be a source of great frustration to our users. Which is why we find it important to explain where these calls come from and what can be done about them. The cause lies in so-called SIP scanners.
What is a SIP scanner?
SIP scanners are programs that automatically scan the entire internet in search of poorly secured SIP sets. Hackers use such programs with a view to calling out via, for example, an incorrectly configured VoIP-PBX. These programs function via â€˜SIP INVITEâ€™ messages sent to randomly selected devices and IP-addresses on the internet. In some cases a telephone will react to this by ringing.
How can SIP scanners be blocked?
Because the gnTel platform is well secured, such calls do not reach telephones via our platform. Which is why we are unable to block them. This can only be done by means of your own router, firewall or telephone. A set can be adjusted so that it will only accept â€˜INVITEâ€™ messages from known SIP servers. With some switchboards and sets, ghost calls can be refused by turning off the option, â€˜allow anonymous callsâ€™ or â€˜direct IP calls.â€™ Precisely how the option is worded can be found by consulting the manual for your switchboard or set, or you can obtain this information by contacting the supplier or importer of the unit.
You can set your router or firewall in such a way that SIP messages can only reach your sets from gnTel IP addresses. The relevant IP address is that of the gnTel SIP server, namely: sip.gntel.nl or 188.8.131.52. By ensuring that SIP messages from/to port 5060 (the SIP port) can reach your sets solely via that address, you will prevent messages from the SIP scanners from reaching your set(s). Every router/firewall is adjusted differently, so that the manual is your best source of information. Otherwise, it would be advisable to get in touch with the supplier or importer.