Or, more likely, you're being scanned to attempt exploit. This is particularly the case if it seems like you're seeing a bunch of random extensions that you've never configured a phone with. Trunk build of FS will show the IP of the incoming registration requests. In my case, I had a stray phone that I forgot to reconfigure, but had to resort to tcpdump/wireshark to find where the requests were coming from, hence the patch. -- Nathan On 03/21/2013 07:12 PM, Steven Schoch wrote:
On Thu, Mar 21, 2013 at 4:46 PM, Malay Thakershi <mthakershi@gmail.com <mailto:mthakershi@gmail.com>> wrote:
2013-03-21 16:03:50.795593 [WARNING] sofia_reg.c:2376 Can't find user [504@IP.IP.IP.IP] You must define a domain called 'IP.IP.IP.IP' in your directory and add a user with the id="504" attribute and you must configure your device to use the proper domain in it's authentication credentials.
That means there is a phone on your LAN that is trying to register as user (extension) 504, but you haven't created a directory entry for that user in the directory/default/ folder. I.e. it means "unknown user".
-- Steve
-- ------------------------------------------------------------ Nathan Neulinger nneul@mst.edu Missouri S&T Information Technology (573) 612-1412 System Administrator - Architect