[Freeswitch-users] Seem to be attacked, CPU rate 95%, stop working, no log output.

[Stanislav Sinyagin]

But do you see an excessive amount of SIP messages coming to your server?
On Jun 26, 2015 6:22 PM, "Eric Ni" <xyangni at gmail.com> wrote:

> Thanks. I have tried this. But today it happen again. When I killed
> freeswith process and restart it, everything back to normal. So it does
> seem to be a DOS attack now. Or restarting fs won't make any difference.
>
> On Sat, Jun 13, 2015 at 1:04 AM, Stanislav Sinyagin <ssinyagin at gmail.com>
> wrote:
>
>> here are iptables rules which do a simple rate limiting for SIP
>> messages, probably this helps:
>> https://txlab.wordpress.com/2013/06/29/protecting-a-vpbx-from-dos-attacks/
>>
>>
>>
>> On Sat, Jun 13, 2015 at 1:46 AM, Eric Ni <xyangni at gmail.com> wrote:
>> > Hi,
>> >
>> > I am using FreeSWITCH Version
>> 1.4.18+git~20150312T185523Z~4eed221b69~64bit
>> > (git 4eed221 2015-03-12 18:55:23Z 64bit) on ubuntu 14.04, Linode VPS.
>> > It has been working fine for about 2 months. But recently it stopped
>> working
>> > with CPU rate above 95% for several times. SIP client got 408 timeout
>> error.
>> > I have to login system to kill the process and start over again.  Then
>> it
>> > back to normal for a period. Checked the log file, it seem to be a
>> sudden
>> > stop. Nothing special before the stop and completely no log starting
>> from
>> > the issue. May I ask how I should handle this issue? Thanks.
>> >
>> > Regards,
>> > Eric
>> >
>> >
>> _________________________________________________________________________
>> > Professional FreeSWITCH Consulting Services:
>> > consulting at freeswitch.org
>> > http://www.freeswitchsolutions.com
>> >
>> > Official FreeSWITCH Sites
>> > http://www.freeswitch.org
>> > http://confluence.freeswitch.org
>> > http://www.cluecon.com
>> >
>> > FreeSWITCH-users mailing list
>> > FreeSWITCH-users at lists.freeswitch.org
>> > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> > UNSUBSCRIBE:
>> http://lists.freeswitch.org/mailman/options/freeswitch-users
>> > http://www.freeswitch.org
>>
>> _________________________________________________________________________
>> Professional FreeSWITCH Consulting Services:
>> consulting at freeswitch.org
>> http://www.freeswitchsolutions.com
>>
>> Official FreeSWITCH Sites
>> http://www.freeswitch.org
>> http://confluence.freeswitch.org
>> http://www.cluecon.com
>>
>> FreeSWITCH-users mailing list
>> FreeSWITCH-users at lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org
>>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://confluence.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20150626/05896701/attachment-0001.html