[Freeswitch-users] Spoofed CID?

[Steven Ayre]

There's no way of knowing really.

You can send any CID you like in SIP. They might own 4433669222 in real
life, they might not. You only really get a guarantee it's genuine if it's
coming off the PSTN.

All I can tell you is 44336 is a valid UK phone number prefix (
http://en.wikipedia.org/wiki/03_numbers).

-Steve



On 19 May 2011 03:01, mazilo <Nabble at slickdeals.endjunk.com> wrote:

> Today, after my phone rang with a CID of (443)366-9222, I took a look at
> /var/log/freeswitch/freeswitch.log file on my Seagate DockStar (excerpted
> below). What caught my attention is the last line which shows two numbers,
> namely 4433669222 and 4016488312. The question I have is if 4433669222 is a
> spoofed number?
>
> 2011-05-18 12:54:03.258849 [NOTICE] switch_channel.c:812 New Channel
> sofia/external/4433669222 at 64.154.
> 2011-05-18 12:54:03.258849 [DEBUG] sofia.c:4744 Channel
> sofia/external/4433669222 at 64.154.41.150 enteri
> 2011-05-18 12:54:03.258849 [DEBUG] sofia.c:4755 Remote SDP:
> v=0^M
> o=root 241964608 241964608 IN IP4 64.154.41.150^M
> s=Asterisk PBX 1.6.2.13^M
> c=IN IP4 64.154.41.150^M
> t=0 0^M
> m=audio 10730 RTP/AVP 0 8 3 18 101^M
> a=rtpmap:0 PCMU/8000^M
> a=rtpmap:8 PCMA/8000^M
> a=rtpmap:3 GSM/8000^M
> a=rtpmap:18 G729/8000^M
> a=fmtp:18 annexb=no^M
> a=rtpmap:101 telephone-event/8000^M
> a=fmtp:101 0-16^M
> a=ptime:20^M
>
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:4637 Audio Codec Compare
> [PCMU:0:8000:20:64000]/[G7221
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:4637 Audio Codec Compare
> [PCMU:0:8000:20:64000]/[G7221
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:4637 Audio Codec Compare
> [PCMU:0:8000:20:64000]/[G722:
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:4637 Audio Codec Compare
> [PCMU:0:8000:20:64000]/[PCMU:
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:2760 Set Codec
> sofia/external/4433669222 at 64.154.41.150
> 2011-05-18 12:54:03.258849 [DEBUG] sofia_glue.c:4751 Set 2833 dtmf
> send/recv
> payload to 101
> 2011-05-18 12:54:03.258849 [DEBUG] sofia.c:4922
> (sofia/external/4433669222 at 64.154.41.150) State Change
>
> 2011-05-18 12:54:03.258849 [DEBUG] sofia.c:4922
> (sofia/external/4433669222 at 64.154.41.150) State Change
> 2011-05-18 12:54:03.258849 [DEBUG] switch_core_session.c:1116 Send signal
> sofia/external/4433669222 at 64
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:320
> (sofia/external/4433669222 at 64.154.4
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:356
> (sofia/external/4433669222 at 64.154.4
> 2011-05-18 12:54:03.265631 [DEBUG] mod_sofia.c:84
> sofia/external/4433669222 at 64.154.41.150 SOFIA INIT
> 2011-05-18 12:54:03.265631 [DEBUG] mod_sofia.c:124
> (sofia/external/4433669222 at 64.154.41.150) State Cha
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_session.c:1116 Send signal
> sofia/external/4433669222 at 64
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:356
> (sofia/external/4433669222 at 64.154.4
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:320
> (sofia/external/4433669222 at 64.154.4
> 2011-05-18 12:54:03.265631 [DEBUG] switch_channel.c:1668
> (sofia/external/4433669222 at 64.154.41.150) Cal
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:359
> (sofia/external/4433669222 at 64.154.4
> 2011-05-18 12:54:03.265631 [DEBUG] mod_sofia.c:147
> sofia/external/4433669222 at 64.154.41.150 SOFIA ROUTI
> 2011-05-18 12:54:03.265631 [DEBUG] switch_core_state_machine.c:77
> sofia/external/4433669222 at 64.154.41.
> 2011-05-18 12:54:03.265631 [INFO] mod_dialplan_xml.c:331 Processing
> 4433669222 <4433669222>->401648831
>
>
> -----
> FreeSWITCH hosted on a Seagate DockStar with OpenWRT and ONLY consumes 3
> Watts of electricity.
> --
> View this message in context:
> http://freeswitch-users.2379917.n2.nabble.com/Spoofed-CID-tp6380373p6380373.html
> Sent from the freeswitch-users mailing list archive at Nabble.com.
>
> _______________________________________________
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20110519/2bbf6207/attachment.html