<p>Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically</p>
<div class="gmail_quote">Den 2010 10 5 20:53 skrev "Anthony Minessale" <<a href="mailto:anthony.minessale@gmail.com">anthony.minessale@gmail.com</a>>:<br type="attribution">> Are you perhaps getting ddos'd by some sip scanner?<br>
> <br>> <br>> On Tue, Oct 5, 2010 at 12:55 PM, Mario <<a href="mailto:mario_fs@mgtech.com">mario_fs@mgtech.com</a>> wrote:<br>>> Starting last night at 2am (it had been up for 10 hours) FS issued:<br>
>> 1440 Auto-Adding Alias [208.2.3.4] for profile [internal].<br>>> Now, when I start FS I get the message right away and heavy disk<br>>> thrashing. For the last couple of weeks while working on FS this<br>
>> messages never came up (that I noticed). The machine goes to 100 percent<br>>> processor and the disk thrashes. I removed all external SIP accounts and<br>>> the ip-v6 profile to test and it still happens. This came out of the<br>
>> blue and stopped everything I was working on. Looking into this all I<br>>> could find was it may be related to UPnP which the router has. Had been<br>>> working fine until now. Any help greatly appreciated. Mario<br>
>><br>>> When I issue the shutdown command FS end with an error:<br>>><br>>> 2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401<br>>> mod_siren has no shutdown routine<br>>> 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518<br>
>> Deleting Codec SPEEX 99 Speex 32000hz 20ms<br>>> 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518<br>>> Deleting Codec SPEEX 99 Speex 16000hz 20ms<br>>> 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518<br>
>> Deleting Codec SPEEX 99 Speex 8000hz 20ms<br>>> 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401<br>>> mod_speex has no shutdown routine<br>>> Segmentation fault (core dumped)<br>
>><br>>> Name Type<br>>> Data State<br>>> =================================================================================================<br>>> 210.17.234.127 alias<br>
>> internal ALIASED<br>>> internal profile<br>>> <a href="http://sip:mod_sofia@100.24.1.37:5060">sip:mod_sofia@100.24.1.37:5060</a> RUNNING (0)<br>>> external profile<br>
>> <a href="http://sip:mod_sofia@100.24.1.37:5080">sip:mod_sofia@100.24.1.37:5080</a> RUNNING (0)<br>>> 100.24.1.37 alias<br>>> internal ALIASED<br>>> =================================================================================================<br>
>> 2 profiles 2 aliases<br>>><br>>> _______________________________________________<br>>> FreeSWITCH-users mailing list<br>>> <a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
>> <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>>> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
>> <a href="http://www.freeswitch.org">http://www.freeswitch.org</a><br>>><br>> <br>> <br>> <br>> -- <br>> Anthony Minessale II<br>> <br>> FreeSWITCH <a href="http://www.freeswitch.org/">http://www.freeswitch.org/</a><br>
> ClueCon <a href="http://www.cluecon.com/">http://www.cluecon.com/</a><br>> Twitter: <a href="http://twitter.com/FreeSWITCH_wire">http://twitter.com/FreeSWITCH_wire</a><br>> <br>> AIM: anthm<br>> <a href="mailto:MSN%3Aanthony_minessale@hotmail.com">MSN:anthony_minessale@hotmail.com</a><br>
> GTALK/JABBER/<a href="mailto:PAYPAL%3Aanthony.minessale@gmail.com">PAYPAL:anthony.minessale@gmail.com</a><br>> IRC: <a href="http://irc.freenode.net">irc.freenode.net</a> #freeswitch<br>> <br>> FreeSWITCH Developer Conference<br>
> <a href="mailto:sip%3A888@conference.freeswitch.org">sip:888@conference.freeswitch.org</a><br>> <a href="mailto:googletalk%3Aconf%2B888@conference.freeswitch.org">googletalk:conf+888@conference.freeswitch.org</a><br>
> pstn:+19193869900<br>> <br>> _______________________________________________<br>> FreeSWITCH-users mailing list<br>> <a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
> <a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>> UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
> <a href="http://www.freeswitch.org">http://www.freeswitch.org</a><br></div>