[Freeswitch-users] Open and closing channels continously

[Michael Jerris]

Looks like sip scanners trying to own your system.  You can turn on sip trace to see more.  Fail2ban is maybe useful for this.

> On Aug 21, 2018, at 5:37 AM, Jose David Jurado Alonso <josedavid at zennio.com> wrote:
> 
> Hi,
> 
> 
> I'm just observing in the log that user 1001 (and other random users like '55340115419480247') is continuously creating and closing channels.
> 
> That users doesn't exist (I delete the folder "directory" since I use database with different user names, no numbers).
> 
> I've done a search some reference to user 1001 in all the configuration and haven't found anything (using "grep -r '1001' /etc/freeswitch/*")
> 
> Any idea why this happens? A bot or spider maybe?
> 
> 
> 
> Log trace example:
> 
> 2018-08-21 09:34:50.448541 [WARNING] switch_core_state_machine.c:687 1f89de01-b82f-44fa-9b91-9d111c44e220 sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> Abandoned
> 2018-08-21 09:34:50.448541 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [CS_NEW] [WRONG_CALL_STATE]
> 2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1731 Session 291 (sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120>) Ended
> 2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [CS_DESTROY]
> 2018-08-21 09:34:51.288542 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [f8be20e3-1244-48bb-a89b-7b49382726af]
> 2018-08-21 09:34:52.568543 [WARNING] switch_core_state_machine.c:687 bae7044c-4915-4a9a-9265-6e48e969ffec sofia/internal/55340115419480247 at 192.168.1.120 <mailto:55340115419480247 at 192.168.1.120> Abandoned
> 2018-08-21 09:34:52.568543 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/55340115419480247 at 192.168.1.120 <mailto:55340115419480247 at 192.168.1.120> [CS_NEW] [WRONG_CALL_STATE]
> 2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1731 Session 292 (sofia/internal/55340115419480247 at 192.168.1.120 <mailto:55340115419480247 at 192.168.1.120>) Ended
> 2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/55340115419480247 at 192.168.1.120 <mailto:55340115419480247 at 192.168.1.120> [CS_DESTROY]
> 2018-08-21 09:34:52.848563 [WARNING] switch_core_state_machine.c:687 a0a39ab8-f109-468b-8136-3ebf044c2ffd sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> Abandoned
> 2018-08-21 09:34:52.848563 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [CS_NEW] [WRONG_CALL_STATE]
> 2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1731 Session 293 (sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120>) Ended
> 2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [CS_DESTROY]
> 2018-08-21 09:34:54.248541 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> [ef2d84f4-89e5-453d-89df-8280b129b42b]
> 2018-08-21 09:34:55.148543 [WARNING] switch_core_state_machine.c:687 9f1804f2-80d0-4fad-8e43-40f0cf2777e9 sofia/internal/1001 at 192.168.1.120 <mailto:1001 at 192.168.1.120> Abandoned

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20180821/7a6771dd/attachment.html>