[asterisk-users] Called number changed on SNOM 821

[Antony Stone]

On Tuesday 28 December 2021 at 20:07:22, Luca Bertoncello wrote:

> Am 28.12.2021 um 20:00 schrieb Antony Stone:
> > 
> > From your earlier packet capture, it looked to me like you were dialling
> > an external number from an internal telephone.
> 
> This is correct!
> I called my mobile phone using a VoIP phone connected to an Asterisk.
> 
> > If that is true, then you should be looking for a packet *from Telekom*
> > coming in to Asterisk, and a packet *from Asterisk* to the internal
> > telephone - remember that these packets are the _reply_ to the INVITE.
> > 
> > INVITE goes from callING telephone to callED telephone.
> > 
> > Response "180 Ringing" goes from the callED telephone to the callING
> > telephone.
> 
> So do I have to compare the INVITE with the Ringing?

No, you want to look at the "180 Ringing" response in both cases - what goes 
in to Asterisk, and what comes out of it.

The INVITE does not contain the data which gets displayed on the calling 
telephone.

> OK, so I have to sniff the data to Deutsche Telekom and not the internal
> network...

No, data FROM Deutsche Telekom.  They are the ones sending the "180 Ringing" 
back to you once they think the external telephone is ringing.

> Since the Asterisk is not my own, but of a company, I have to ask
> someone to call me from the phone when I sniff the traffic...
> I hope, I find someone tomorrow.

I don't quite follow that, but what I am saying is that the callEE's number 
(the number of the telephone you are calling) may be contained in an RPID 
header of the "180 Ringing" packet which comes back from the telephone being 
called.

You want to find out whether this header, and the strange number you are not 
expecting, exists in the packets coming from your upstream provider IN to 
Asterisk, and also whether it exists in the packet coming FROM asterisk to 
your internal telephone which made the call, and is showing the strange data.


I hope that is clear.


Antony.

-- 
These clients are often infected by viruses or other malware and need to be 
fixed.  If not, the user at that client needs to be fixed...

 - Henrik Nordstrom, on Squid users' mailing list

                                                   Please reply to the list;
                                                         please *don't* CC me.