A ghost call is a call that shows up in a voice system without a real conversation behind it. The phone rings and nobody is there, or a session opens, gets logged as a call and closes again without carrying any speech. The term covers a family of symptoms rather than one single fault, but they share a common thread: the system thinks a call happened when, from a human point of view, nothing did.
Ghost calls are easy to dismiss as a nuisance. One phantom ring or one empty recording rarely causes harm. The trouble starts when they pile up. Hundreds of ghost calls can flood call logs and recorders, waste network and processing capacity, and send troubleshooting teams after the wrong root cause. They are also a symptom. Behind every ghost call sits something worth knowing about, whether that is a security probe, a misconfigured network element or a radio receiver picking up interference.
How ghost calls happen
Every voice call has two parts: signalling, which sets up and tears down the session, and media, which carries the actual audio. In IP networks, SIP usually handles the signalling and RTP carries the voice. A ghost call happens when these two parts fall out of step, or when something triggers the signalling side without a real speaker behind it.
There are three broad patterns. In the first, the call setup is not genuine at all. An automated scanner or a misrouted message creates a call attempt that rings a phone or opens a session, but no person ever intended to call. In the second, the call setup is real but the media never arrives. The session is established, both ends think they are connected, and the line stays silent because the RTP stream is blocked, misdirected or never sent. In the third, common in radio-based systems, a brief spurious trigger, such as a burst of noise that opens a receiver’s squelch, creates a short session that the system treats as a transmission.
What makes ghost calls tricky is that each part of the system often behaves correctly on its own terms. The phone rang because it received a valid INVITE. The recorder recorded because it received a valid event. The fault only becomes visible when you look at signalling, media and audio together.
Ghost calls in telecom networks
In enterprise and carrier VoIP networks, the most familiar ghost call is the phantom ring. An IP phone rings, often at odd hours, and when someone picks up there is nobody on the line. The caller ID may show a strange short number or nothing at all. The usual cause is SIP scanning: automated tools sweep the internet for SIP devices and send them unsolicited INVITE messages to see which ones respond. A phone or PBX exposed directly to the internet answers those probes the only way it knows how, by ringing. Beyond the annoyance, this is a warning sign. Scanning is often the first step in a toll fraud attempt, where attackers look for weakly protected accounts to place expensive calls.
The second telecom flavor is the silent call, closely related to one-way audio. Here the call is legitimate and the signalling completes, but one or both parties hear nothing. NAT traversal problems, firewall rules that block RTP ports, SDP that advertises the wrong IP address and codec mismatches are among the most common causes. From the network’s point of view, the call connected and lasted a normal amount of time. From the customer’s point of view, it failed. Customers rarely report these calls in detail. They hang up, redial and lose a little more confidence in the service.
Both types share one trait: they are invisible to monitoring that only looks at signalling. Call detail records show a completed call. Detecting a ghost call means checking whether media actually flowed, in both directions, and whether it carried real audio. Patterns matter too. A spike in very short calls, calls from unusual sources or sessions with no RTP at all is often the earliest sign that something in the network has changed.
Ghost calls in air traffic control
In air traffic control, ghost calls take a different shape. Modern IP-based voice communication systems built on the EUROCAE ED-137 standard treat radio activity as events. When a ground radio receiver detects a signal and its squelch opens, the radio gateway signals that event and streams the audio as RTP to the voice communication system and the digital voice recorder (DVR). The recorder captures each of these events as a separate air-ground call.
A ghost call in this context is an extremely short squelch event, often lasting less than 100 milliseconds, that contains no usable audio. RF interference, a faulty receiver, a degraded antenna system or background noise sitting right at the squelch threshold can all trigger one. Each event is far too short to carry speech, so controllers may never notice it. The infrastructure does. Every squelch opening generates signalling, an RTP stream and a new entry in the recorder.
Cross coupling makes the problem much worse. When frequencies are coupled, audio from one is retransmitted on the others, so a single spurious squelch event can turn into several recorded events across the coupled channels. One noisy receiver can multiply ghost calls across a whole coupling group.
A real customer case shows how this plays out. A newly installed DVR kept crashing. The investigation naturally started with the recorder and its vendor, and the recorder was indeed struggling with performance. The root cause sat elsewhere. The DVR was flooded with ghost call recordings, each lasting under 100 milliseconds and carrying no audio, and frequency coupling multiplied them until the recorder hit its limits. The breakthrough came when the team searched the monitoring data for unusual spikes in short squelch events. That pattern led straight to the radio site causing the problem: an RF issue that had spilled over into the VoIP service.
This is why ghost calls matter in ATC even when no transmission is lost. They point to RF problems that may later affect real transmissions. They load recorders that play a legal and investigative role. And they pull troubleshooting effort in the wrong direction. Continuous monitoring of squelch behaviour and RTP streams turns ghost calls from a mystery into a measurable pattern that can be traced back to a specific radio, site or frequency.
Detecting and preventing ghost calls
The hardest part of dealing with ghost calls is recognizing them. Each individual event looks harmless or even valid, so the useful signal lies in the pattern: how many short or empty calls occur, where they come from and whether that number is changing over time. A baseline of normal activity makes spikes stand out quickly.
Prevention depends on the source. In telecom networks, keeping SIP endpoints off the public internet, routing traffic through a properly configured session border controller and restricting which sources can send INVITEs removes most scanning-related ghost calls. Silent calls need attention to NAT, firewall and SDP handling, plus monitoring that checks media flow on every call, not just a sample.
In ATC, the fix usually lives at the radio layer: tracking down interference, repairing or replacing faulty receivers and antennas, and reviewing squelch thresholds that sit too close to the noise floor. Recorder and VCS settings can filter out events too short to contain speech, but filtering hides the symptom rather than fixing the cause. The real goal is to find the radio site behind the ghost calls, not just to stop recording them.