Misconfigured e.164 addresses in From: field
How common is it that SIP received from a carrier would have a misconfigured e.164 address in the From: field? We are seeing calls from various US numbers appearing with a leading '+', but no '1' country code. Therefore they appear to be originating from a foreign caller. An example would be: From: sip:+208488xxxx at aaa.bb.cc.dd:5060;user=phone Which would appear to be from Egypt (country code: 20) but is really from Boise, Idaho (NPA: 208) We are seeing this from at least one of our carriers. Do we need to just live with this, or should it be something that we try to get fixed? It doesn't impact routing of calls, but it messes up our statistics. --- David Zilk Senior VoIP Engineer Network Solutions CDK Global, LLC Evolving the Automotive Retail Experience 2525 SW 1st Ave Suite 450 Portland, Oregon 97201-4760 o: 503-402-3132 m: 503-753-6591 cdkglobal.com<http://cdkglobal.com/> Follow us on: Twitter<https://twitter.com/CDKGlobal> Facebook<https://www.facebook.com/CDKGlobal> LinkedIn<https://www.linkedin.com/company/1464?trk=vsrp_companies_res_name&trkInfo=VS...> YouTube<https://www.youtube.com/user/adpdealer> ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.
On Wed, Jul 05, 2017 at 09:29:27PM +0000, Zilk, David wrote:
How common is it that SIP received from a carrier would have a misconfigured e.164 address in the From: field?
We are seeing calls from various US numbers appearing with a leading '+', but no '1' country code. Therefore they appear to be originating from a foreign caller. An example would be:
From: sip:+208488xxxx at aaa.bb.cc.dd:5060;user=phone
Which would appear to be from Egypt (country code: 20) but is really from Boise, Idaho (NPA: 208)
We are seeing this from at least one of our carriers. Do we need to just live with this, or should it be something that we try to get fixed? It doesn't impact routing of calls, but it messes up our statistics.
I wouldn't say it's common, but it's radioactively wrong, and may lead to incorrect route selection on outbound legs (e.g. in call forwarding cases) as well as incorrect ANI presentation on certain devices and inter-network. You should definitely try to get it fixed. -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/
+1 on this reply. The + symbol has a very specific meaning, even Wikipedia nicely defines it. E164 notation is not something you can just throw around like that. It?s wrong. It should be fixed. On 7/5/17, 2:31 PM, "VoiceOps on behalf of Alex Balashov" <voiceops-bounces at voiceops.org on behalf of abalashov at evaristesys.com> wrote: On Wed, Jul 05, 2017 at 09:29:27PM +0000, Zilk, David wrote: > How common is it that SIP received from a carrier would have a > misconfigured e.164 address in the From: field? > > We are seeing calls from various US numbers appearing with a leading > '+', but no '1' country code. Therefore they appear to be originating > from a foreign caller. An example would be: > > From: sip:+208488xxxx at aaa.bb.cc.dd:5060;user=phone > > Which would appear to be from Egypt (country code: 20) but is really > from Boise, Idaho (NPA: 208) > > We are seeing this from at least one of our carriers. Do we need to > just live with this, or should it be something that we try to get > fixed? It doesn't impact routing of calls, but it messes up our > statistics. I wouldn't say it's common, but it's radioactively wrong, and may lead to incorrect route selection on outbound legs (e.g. in call forwarding cases) as well as incorrect ANI presentation on certain devices and inter-network. You should definitely try to get it fixed. -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
On 7/5/17 2:31 PM, Alex Balashov wrote:
I wouldn't say it's common, but it's radioactively wrong, and may lead to incorrect route selection on outbound legs (e.g. in call forwarding cases) as well as incorrect ANI presentation on certain devices and inter-network.
As well as undesired and rather expensive results should the called party attempt to return a call.
You should definitely try to get it fixed.
+1 -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV
It turns out that the majority of the bad From: numbers (from one carrier) are apparently spoofed CLIDs associated with scam calls. Some of them are identified in the various "Who Called Me" lists, others are completely invalid. Many also have "p=+1 6135555555" in their SDP, which is obviously an invalid number, but is also called out in the lists as a CLID used by scam calls. Other numbers being used are: +2084886650 +406 +5480689 +86652129066 +96171762170 So there is probably nothing we can do about it. David -----Original Message----- From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of Jay Hennigan Sent: Tuesday, July 11, 2017 08:08 To: voiceops at voiceops.org Subject: Re: [VoiceOps] Misconfigured e.164 addresses in From: field On 7/5/17 2:31 PM, Alex Balashov wrote:
I wouldn't say it's common, but it's radioactively wrong, and may lead to incorrect route selection on outbound legs (e.g. in call forwarding cases) as well as incorrect ANI presentation on certain devices and inter-network.
As well as undesired and rather expensive results should the called party attempt to return a call.
You should definitely try to get it fixed.
+1 -- Jay Hennigan - CCIE #7880 - Network Engineering - jay at impulse.net Impulse Internet Service - http://www.impulse.net/ Your local telephone and internet company - 805 884-6323 - WB6RDV _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops ---------------------------------------------------------------------- This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong. On Wed, Jul 5, 2017 at 2:29 PM, Zilk, David <David.Zilk at cdk.com> wrote:
How common is it that SIP received from a carrier would have a misconfigured e.164 address in the From: field?
We are seeing calls from various US numbers appearing with a leading ?+?, but no ?1? country code. Therefore they appear to be originating from a foreign caller. An example would be:
From: sip:+208488xxxx at aaa.bb.cc.dd:5060;user=phone
Which would appear to be from Egypt (country code: 20) but is really from Boise, Idaho (NPA: 208)
We are seeing this from at least one of our carriers. Do we need to just live with this, or should it be something that we try to get fixed? It doesn?t impact routing of calls, but it messes up our statistics.
---
*David Zilk *
Senior VoIP Engineer
Network Solutions
*CDK Global, LLC* Evolving the Automotive Retail *Experience*
2525 SW 1st Ave
Suite 450
Portland, Oregon 97201-4760
o: 503-402-3132 <(503)%20402-3132>
m: 503-753-6591 <(503)%20753-6591>
cdkglobal.com
Follow us on:* Twitter <https://twitter.com/CDKGlobal> Facebook <https://www.facebook.com/CDKGlobal> LinkedIn <https://www.linkedin.com/company/1464?trk=vsrp_companies_res_name&trkInfo=VS...> YouTube <https://www.youtube.com/user/adpdealer>*
------------------------------ This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, notify the sender immediately by return email and delete the message and any attachments from your system.
_______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
On Wed, Jul 05, 2017 at 02:41:57PM -0700, Carlos Alvarez wrote:
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong.
Yeah, but there's a difference between quirks in representation versus an overt misstatement of the ANI. +208 is not +1208. -- Alex Balashov | Principal | Evariste Systems LLC Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/
Yes, they do that. We got over it and coded around it. On Wed, Jul 5, 2017 at 2:44 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
On Wed, Jul 05, 2017 at 02:41:57PM -0700, Carlos Alvarez wrote:
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong.
Yeah, but there's a difference between quirks in representation versus an overt misstatement of the ANI. +208 is not +1208.
-- Alex Balashov | Principal | Evariste Systems LLC
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
So how do you know when you're really getting a call from Egypt? On July 5, 2017 5:51:15 PM EDT, Carlos Alvarez <caalvarez at gmail.com> wrote:
Yes, they do that. We got over it and coded around it.
On Wed, Jul 5, 2017 at 2:44 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
On Wed, Jul 05, 2017 at 02:41:57PM -0700, Carlos Alvarez wrote:
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong.
Yeah, but there's a difference between quirks in representation versus an overt misstatement of the ANI. +208 is not +1208.
-- Alex Balashov | Principal | Evariste Systems LLC
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
-- Alex -- Principal, Evariste Systems LLC (www.evaristesys.com) Sent from my Google Nexus.
Ah, sorry, I originally misread the post as meaning the calls were destined to that DID and it was presented incorrectly. For CLID, we don't care, just pass on the wrong number. Nobody seems to care. On Wed, Jul 5, 2017 at 2:52 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
So how do you know when you're really getting a call from Egypt?
On July 5, 2017 5:51:15 PM EDT, Carlos Alvarez <caalvarez at gmail.com> wrote:
Yes, they do that. We got over it and coded around it.
On Wed, Jul 5, 2017 at 2:44 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
On Wed, Jul 05, 2017 at 02:41:57PM -0700, Carlos Alvarez wrote:
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong.
Yeah, but there's a difference between quirks in representation versus an overt misstatement of the ANI. +208 is not +1208.
-- Alex Balashov | Principal | Evariste Systems LLC
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
-- Alex
-- Principal, Evariste Systems LLC (www.evaristesys.com)
Sent from my Google Nexus. _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
Well, perhaps. But bad CLID will impact things like interstate vs intrastate route selection on outbound LCR, of for example that CLID is turned around and forwarded back out to the PSTN. And it will cause you to run a afoul of regulations in any other situation where you should not be placing out of state and/or internationally originated traffic onto some given trunk group. On July 5, 2017 5:57:17 PM EDT, Carlos Alvarez <caalvarez at gmail.com> wrote:
Ah, sorry, I originally misread the post as meaning the calls were destined to that DID and it was presented incorrectly. For CLID, we don't care, just pass on the wrong number. Nobody seems to care.
On Wed, Jul 5, 2017 at 2:52 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
So how do you know when you're really getting a call from Egypt?
On July 5, 2017 5:51:15 PM EDT, Carlos Alvarez <caalvarez at gmail.com> wrote:
Yes, they do that. We got over it and coded around it.
On Wed, Jul 5, 2017 at 2:44 PM, Alex Balashov <abalashov at evaristesys.com> wrote:
On Wed, Jul 05, 2017 at 02:41:57PM -0700, Carlos Alvarez wrote:
Common enough that we have a huge pre-processing section at the beginning of every call to normalize the various stupid ways carriers might send the info. Something like six variables covering all the ways they do it wrong.
Yeah, but there's a difference between quirks in representation versus an overt misstatement of the ANI. +208 is not +1208.
-- Alex Balashov | Principal | Evariste Systems LLC
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) Web: http://www.evaristesys.com/, http://www.csrpswitch.com/ _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
-- Alex
-- Principal, Evariste Systems LLC (www.evaristesys.com)
Sent from my Google Nexus. _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
-- Alex -- Principal, Evariste Systems LLC (www.evaristesys.com) Sent from my Google Nexus.
Am 05.07.2017 um 23:52 schrieb Alex Balashov:
So how do you know when you're really getting a call from Egypt?
In this case, he's lucky, because Egypt has minimum 2 digits area code + minimum 8 digits subscriber number. E.g. +20-12-12345678 (at least 12 digits total) vs. a call from Idaho would be fixed length +208-123-4567 (10 digits). So he could run his pre-processing only on numbers that are longer than 10 digits :)
Yeah, in this case. But plenty of places have shorter numbers that, together with country code, end up ten digit, or open dial plans where some numbers would amount to ten digits. Some of them will inevitably overlap with US NPAs. On July 5, 2017 6:02:55 PM EDT, Markus <universe at truemetal.org> wrote:
Am 05.07.2017 um 23:52 schrieb Alex Balashov:
So how do you know when you're really getting a call from Egypt?
In this case, he's lucky, because Egypt has minimum 2 digits area code + minimum 8 digits subscriber number. E.g. +20-12-12345678 (at least 12 digits total) vs. a call from Idaho would be fixed length +208-123-4567
(10 digits). So he could run his pre-processing only on numbers that are longer than 10 digits :) _______________________________________________ VoiceOps mailing list VoiceOps at voiceops.org https://puck.nether.net/mailman/listinfo/voiceops
-- Alex -- Principal, Evariste Systems LLC (www.evaristesys.com) Sent from my Google Nexus.
participants (6)
-
abalashov＠evaristesys.com -
caalvarez＠gmail.com -
d＠d-man.org -
David.Zilk＠cdk.com -
jay＠west.net -
universe＠truemetal.org