First noticed the activity in the asterisk log file. Then used Wireshark to trace the packets.
Sorry, what I meant was how have you detected the inbound SIP connections when the asterisk server has been off?
Just to let you know, I've had contact from a higher technical authority in BT and we are now working together to identify the problem. Thanks to BT for getting involved with this.
Are you sure this isn't Hole punching ?.. I'm pretty certain SIP does this to get around firewall issues. A simple check is stop astrix and use one of the many online tools that check if a port is open.
Hi, already covered that off. And SIP cannot "punch" holes in a firewall!
I now have a wireshark trace that has been passed to BT for them to discuss with the HH3 manufacturer.
BT and the manufacturer have completed their investigation. The HH3 IS allowing inbound SIP traffic from any internet IP. BUT they say its "working as designed"!
Full details here - http://communig8.com/articles/67-technical/143-hh3-security-exposure