How to Stop Ghost Calls

Ghost calls are categorised as a call which comes through normally, but when answered there is no party on the line, along with no audio and a random/non standard number is presented on the call. This issue occurs almost exclusively on SIP phones, due to the way they function.

The first thing that needs to be established is that these are NOT valid calls. The issue is caused by 3rd parties, who are sending SIP INVITE messages to public IP addresses. When the SIP message is received by a router, if there is an active open port on the router which matches the port on the SIP INVITE, then the router will forward this through to the internal device which opened the port in the first place.

When the phone receives the INVITE message, it will start to ring, as the receipt of an INVITE message is what usually triggers this. However, if you answer the call, there will be nothing there, as the INVITE is not genuine.

3rd parties do this mostly to identify which public IP addresses are using SIP devices (they will focus on common SIP ports, such as 5060/5061). The reason they do this could be for innocent reasons, but most of the time it is done to try and identify potential SIP targets to hack into. This sounds far worse than it is. This type of activity is very common on the internet today, and as long as basic security steps have been employed, you should have nothing to worry about.

The above issue will usually only affect handsets which are directly connected to the internet, such as people using our Hosted PBX service. Customers utilising their own PBX shouldn't be affected by the above, as their PBX will filter the unwanted SIP traffic out. IP phones, though, are not intelligent, so will usually just accept anything that is sent to them.

So, how do you stop it? Well, the first thing is that Numbergroup cannot stop this from occurring. As explained above, the SIP traffic is not passing through our network, it passes directly from the 3rd party to your internet connected router.

As such, you will need to perform a few things on your own internal network to prevent the issue from occurring. The first thing you can do, which these days should be pretty commonplace, is to firewall your internet connection. To be more specific, you will need to block all SIP traffic that isn't originating from our own network. As your inbound SIP traffic will only ever come from our IP addresses, these should be the only ones you need to listen to.

The other thing you can do, which is dependant on whether your IP handset support it, is to disable direct IP calling. As the INVITE messages will not be originating from a proper domain, which all genuine messages should, you can tell the phone to ignore direct IP SIP messages, which will in turn prevent the phone from acknowledging the SIP messages from the 3rd party. 

Another feature which is available sets the phone to only accept traffic from the main SIP domain you are registered to. This feature is handset dependant however. This is enabled by default on Grandstream handsets which we maintain.

If you require any further assistance on the above, please e-mail help@numbergroup.com and we will assist you further.