[Freeswitch-users] How to check who is attacking my fs server?

[Jeff Leung]

You can use xml_cdr to log all calls going through your box. Xml_cdr tends
to capture almost everything including where the UDP packet came from IP
header wise.

 

You can also try Brain West's blacklist here:


http://daffy.bkw.org/blacklist.txt

 

That black list blocks IPs that are known to be attacking boxes and so far,
it's pretty freaking effective against them ;)

 

From: freeswitch-users-bounces at lists.freeswitch.org
[mailto:freeswitch-users-bounces at lists.freeswitch.org] On Behalf Of Jessica
Wang
Sent: Sunday, August 11, 2013 2:03 AM
To: FreeSWITCH Users Help
Subject: [Freeswitch-users] How to check who is attacking my fs server?

 

Dear all,

 

My FS server got attacked by someone. Unknown external user 107 is
frequently calling strange number on my FS server. From the log, I can not
find the real IP of this external user, the IP logged is my server's IP!

 How can check who is doing this and block any similar action?

 Part of the log is as below. 

 

Thanks. 

 

 

 

 2013-08-11 09:48:12.401286 [NOTICE] switch_channel.c:951 New Channel
sofia/external/107@(my fs server ip addr)
[c1499822-0262-11e3-af23-2d4b950c464a]

2013-08-11 09:48:12.421101 [INFO] mod_dialplan_xml.c:485 Processing 107
<107>->+970598610587 in context public

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130811/4a718262/attachment.html