Thanks for the reply, the first thing I checked was the call forward on all lines and trunks, nada. I made test calls into every port, it rang thru, so not sure. My next step is to get a tshark of everything in and out of the network. This is a voip only dsl so it should be easy to do. As an interim, we have instituted a pin number for overseas calls with a disable on 4 errors. . Thanks again. Darcy 199.187156 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: SDP RTPMAP 100 --> 255\n 199.188847 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: SDP RTPMAP 101 --> 136\n 199.190438 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [BCC]CallRoute:L1,2,3,401137744616847\n 199.191655 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [BCC]CallRoute:L1,2,3,401137744616847\n 199.199951 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: pri-->INVITE-->pub\n 199.200916 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: pri-->INVITE-->pub\n 199.202721 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@my.company.ca:0\n 199.215750 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(985)\n 199.217288 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(985)\n 199.228906 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog INVITE sip:01137744616847@my.company.ca SIP/2.0\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>\r\nRemote-Party-ID: "ivory dental" <sip:6132161111@my.company.ca>;screen=yes;party=calling\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nMax-Forwards: 70\r\nContact: "ivory dental" <sip:6132161111@xx.xxx.xxx.41:16598>\r\nExpires: 240\r\nUser-Agent: Linksys/SPA8000-6.1.12\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 265\r\nAllow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER\r\nSupported: x-sipura, replaces\r\nContent-Type: application/sdp\r\n\r\nv=0\r\no=- 81044819 81045805 IN IP4 10.10.1.63\r\ns=eyeBeam\r\nc=IN IP4 10.10.1.63\r\nt=0 0\r\nm=audio 8382 RTP/AVP 100 6 0 8 3 18 5 101\r\na=alt:1 1 : FC106A37 000000A7 10.10.1.63 8382\r\na=fmtp:101 0-15\r\na=rtpmap:100 speex/16000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n 199.229774 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.230739 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.236422 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(410)\n 199.238117 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(410)\n 199.243087 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog SIP/2.0 100 Trying\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609;rport=16598\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120620T194320Z~a0a9efcf02+unclean~20130121T043106Z\r\nContent-Length: 0\r\n\r\n 199.244280 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.245238 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.246773 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(903)\n 199.248491 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]<<xx.xxx.xxx.14:5060(903)\n 199.259707 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog SIP/2.0 407 Proxy Authentication Required\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609;rport=16598\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>;tag=2BXmFrcQ9v74Q\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 INVITE\r\nUser-Agent: FreeSWITCH-mod_sofia/1.2.0-rc2+git~20120620T194320Z~a0a9efcf02+unclean~20130121T043106Z\r\nAccept: application/sdp\r\nAllow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, UPDATE, INFO, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE\r\nSupported: timer, precondition, path, replaces\r\nAllow-Events: talk, hold, presence, dialog, line-seize, call-info, sla, include-session-description, presence.winfo, message-summary, refer\r\nProxy-Authenticate: Digest realm="my.company.ca", nonce="63bcc7dc-298c-11e3-807c-17c4d7454b29", algorithm=MD5, qop="auth"\r\nContent-Length: 0\r\n\r\n 199.260840 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.261745 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: \n 199.269739 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(497)\n 199.271381 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.14:5060(497)\n 199.277953 xx.xxx.xxx.41 -> xx.xxx.xxx.247 Syslog ACK sip:01137744616847@my.company.ca SIP/2.0\r\nVia: SIP/2.0/UDP xx.xxx.xxx.41:16598;branch=z9hG4bK-809a3609\r\nFrom: "ivory dental" <sip:6132161111@my.company.ca>;tag=87c993b11835377fo2;ref=200\r\nTo: <sip:01137744616847@my.company.ca>;tag=2BXmFrcQ9v74Q\r\nCall-ID: 95840519-118b3537@xx.xxx.xxx.41\r\nCSeq: 101 ACK\r\nMax-Forwards: 70\r\nContact: "ivory dental" <sip:6132161111@xx.xxx.xxx.41:16598>\r\nUser-Agent: Linksys/SPA8000-6.1.12\r\nAllow-Events: talk, hold, conference\r\nContent-Length: 0\r\n\r\n ----- Original Message ----- From: Gabe Shepard To: FreeSWITCH Users Help Sent: Monday, September 30, 2013 9:52 AM Subject: Re: [Freeswitch-users] spa8000 hack I don't see the full syslog here, but check to see if there's a call forward number set in the SPA8000? We recently saw an instance where someone set a call forward on an SPA3102, dialed into the 3102 via a different number, and then it was forwarded back out. -Gabe On Mon, Sep 30, 2013 at 1:18 AM, fs <fs@voice2net.ca> wrote: I do not know if anyone has seen this. I use spa8000 ata's to provide sip trunking to a freeswitch an onwards. Over the past three days I have had someone hacking into the spa8000 and relaying international calls back out. I have no ideal how they do it and cannot find any info in the traces that indicates where the call came from. I have seen a note on cisco's web site about someone else complaining about this but no resolution. My syslog from the spa8000 starts like so. Syslog LOCAL2.DEBUG: M0: Calling:01137744616847@sample.switch.ca:0\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xx.xx:5060(985)\n Syslog LOCAL0.INFO: M0: [2]->xx.xxx.xxx.xx:5060(985)\n Syslog INVITE sip:01137744616847@sample.switch.ca SIP/2.0 {etc} Any thoughts or ideas would be REALLY appreciated. Darcy Primrose _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org ------------------------------------------------------------------------------ No virus found in this message. Checked by AVG - www.avg.com Version: 2014.0.4142 / Virus Database: 3604/1 - Release Date: 09/24/13