[Freeswitch-users] Warning messages?

Nathan Neulinger nneul at mst.edu
Fri Mar 22 03:41:47 MSK 2013


Or, more likely, you're being scanned to attempt exploit. This is particularly the case if it seems like you're seeing a 
bunch of random extensions that you've never configured a phone with.

Trunk build of FS will show the IP of the incoming registration requests. In my case, I had a stray phone that I forgot 
to reconfigure, but had to resort to tcpdump/wireshark to find where the requests were coming from, hence the patch.

-- Nathan

On 03/21/2013 07:12 PM, Steven Schoch wrote:
> On Thu, Mar 21, 2013 at 4:46 PM, Malay Thakershi <mthakershi at gmail.com <mailto:mthakershi at gmail.com>> wrote:
>
>
>     2013-03-21 16:03:50.795593 [WARNING] sofia_reg.c:2376 Can't find user [504 at IP.IP.IP.IP]
>     You must define a domain called 'IP.IP.IP.IP' in your directory and add a user with the id="504" attribute
>     and you must configure your device to use the proper domain in it's authentication credentials.
>
>
> That means there is a phone on your LAN that is trying to register as user (extension) 504, but  you haven't created a
> directory entry for that user in the directory/default/ folder.  I.e. it means "unknown user".
>
> --
> Steve
>

-- 
------------------------------------------------------------
Nathan Neulinger                       nneul at mst.edu
Missouri S&T Information Technology    (573) 612-1412
System Administrator - Architect



Join us at ClueCon 2011 Aug 9-11, 2011
More information about the FreeSWITCH-users mailing list