[Freeswitch-users] Strange CDR entry
Telecube - John
john at telecube.com.au
Mon May 13 21:16:11 MSD 2013
Yep, fail2ban is another option.. it's nice to have options.. ;-)
-John
On 14/05/13 2:28 AM, Steven Ayre wrote:
> This is the purpose of the fail2ban system that was already mentioned.
>
> -Steve
>
>
>
> On 13 May 2013 15:52, Telecube - John <john at telecube.com.au
> <mailto:john at telecube.com.au>> wrote:
>
> You can install a log watching program that looks out for specific
> log entries and can take action. Eg; writing a firewall rule to
> ban the ip address of the system trying to make unauthorised calls.
>
> 'swatch' is a good tool for this in linux systems.
>
> http://sourceforge.net/projects/swatch/
>
> John
>
> On 14/05/13 12:35 AM, Ken Rice wrote:
>> Ok look at the 3rd column... This is someone trying to figure out
>> how to get calls thru your public context with various prefix
>> codexs... Notices how all the calls end with 972598371070 <--
>> that's the intl destination umber probably a phone in gaza
>> (definitely in Isreali controlled areas, but I think I looked up
>> this number or similar number in the past)
>>
>> To protect yourself, only allow calls to local extentsions from
>> the public context...
>>
>>
>> On 5/13/13 2:49 AM, "Steven Ayre" <steveayre at gmail.com
>> <http://steveayre@gmail.com>> wrote:
>>
>> The call duration is 0 seconds so no they didn't get in. Any
>> accepted call attempt will generate a CDR even if it was not
>> answered.
>>
>> They're coming in on the 'public' context which'll mean an
>> unauthenticated call on the external profile. That would be
>> the context allowing you to receive calls from strangers.
>> Providing that context doesn't allow them to dial out via
>> providers that charge you this isn't an issue.
>>
>> -Steve
>>
>>
>>
>>
>>
>>
>> On 13 May 2013 07:17, Bala Murugan Mahendran <b2m at a-cti.com
>> <http://b2m@a-cti.com>> wrote:
>>
>> I have lot of entries like 1000,1001,1002 and so on, Is
>> someone trying to get inside? I believe they didn't in
>> yet but how come we have cdr log like this?
>>
>> "1004","1004","012972598371070","public","2013-05-12
>> 07:30:07","","2013-05-12
>> 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","013972598371070","public","2013-05-12
>> 07:30:07","","2013-05-12
>> 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","014972598371070","public","2013-05-12
>> 07:30:07","","2013-05-12
>> 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","010972598371070","public","2013-05-12
>> 07:30:08","","2013-05-12
>> 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","0061972598371070","public","2013-05-12
>> 07:30:08","","2013-05-12
>> 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","0041972598371070","public","2013-05-12
>> 07:30:09","","2013-05-12
>> 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","000972598371070","public","2013-05-12
>> 07:30:09","","2013-05-12
>> 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","006972598371070","public","2013-05-12
>> 07:30:09","","2013-05-12
>> 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","002972598371070","public","2013-05-12
>> 07:30:10","","2013-05-12
>> 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729"
>> "1004","1004","810972598371070","public","2013-05-12
>> 07:29:49","","2013-05-12
>> 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
>>
>>
>> Thanks,
>> Bala
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org <http://consulting@freeswitch.org>
>> http://www.freeswitchsolutions.com
>>
>>
>>
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> <http://FreeSWITCH-users@lists.freeswitch.org>
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>>
>>
>> ------------------------------------------------------------------------
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org <http://consulting@freeswitch.org>
>> http://www.freeswitchsolutions.com
>>
>>
>>
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> <http://FreeSWITCH-users@lists.freeswitch.org>
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>>
>> --
>> Ken
>> _http://www.FreeSWITCH.org
>> http://www.ClueCon.com
>> http://www.OSTAG.org
>> _irc.freenode.net <http://irc.freenode.net> #freeswitch
>>
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org <mailto:consulting at freeswitch.org>
>> http://www.freeswitchsolutions.com
>>
>>
>>
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://wiki.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org <mailto:FreeSWITCH-users at lists.freeswitch.org>
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org <mailto:consulting at freeswitch.org>
> http://www.freeswitchsolutions.com
>
>
>
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> <mailto:FreeSWITCH-users at lists.freeswitch.org>
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
>
>
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130514/5b3bc652/attachment-0001.html
Join us at ClueCon 2011 Aug 9-11, 2011
More information about the FreeSWITCH-users
mailing list