<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">My understanding is the it could have been TCP instead of UDP, also the IP address could have been proxied so what I saw was not correct. They did not register, just tried 8,010 extensions to call out from. I figured the only thing I can do is a PCAP when I catch it (my router can create PCAPs). But no attack in the last 24 hours, go figure. At leaf I have the TCP rule, I will check every few hours, since it lasts for over an hour I am hoping the PCAP will help. I also have the router (Zyxel USG100) emailing me alerts and the logs. BTW, looking further into this I don’t think fail2ban would have worked, this was different. A whitelist is a good idea but I really want to stop it at the firewall if possible. Thanks for all the suggestions, will post if I get a PCAP and figure out how they got in.<div>Mario G<br><div><br><div><div>On May 21, 2014, at 2:30 AM, Steven Ayre <<a href="mailto:steveayre@gmail.com">steveayre@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr">Why do you say it's a class C subnet? He's only mentioned a single IP address, which comes from an ISP that has a /16 block. Class C networks don't really exist any more, especially not on the internet since we have CIDR now.<div>
<br></div><div>It's likely a zombie trawling the network for insecure setups. Blocking a single IP won't work (could be a dynamic IP) and blocking an ISP also won't work (there could be affected machines elsewhere).</div>
<div><br></div><div>Better to either use a whitelist to just allow though allowed IPs on the (non-public?) SIP ports, or use something like fail2ban.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On 20 May 2014 19:12, Sean Devoy <span dir="ltr"><<a href="mailto:sdevoy@bizfocused.com" target="_blank">sdevoy@bizfocused.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Mario,<br>
<br>
Assuming you are not on windows, You need to run this line<br>
iptables -A INPUT -s <a href="http://85.25.198.0/24" target="_blank">85.25.198.0/24</a> -j DROP<br>
<br>
That will block that class C subnet from your system completely. That is the subnet their traffic is coming from. But I am not sure they have not authenticated (registered) on your server. If you are on windows let me know, I can help there too.<br>
<br>
Please send the output from:<br>
iptables -L -v<br>
<br>
and from the FS console:<br>
show registrations<br>
<br>
Sean.<br>
<div><div class="h5"><br>
-----Original Message-----<br>
From: <a href="mailto:freeswitch-users-bounces@lists.freeswitch.org">freeswitch-users-bounces@lists.freeswitch.org</a> [mailto:<a href="mailto:freeswitch-users-bounces@lists.freeswitch.org">freeswitch-users-bounces@lists.freeswitch.org</a>] On Behalf Of Mario G<br>
Sent: Tuesday, May 20, 2014 12:57 PM<br>
To: FreeSWITCH Users Help<br>
Subject: [Freeswitch-users] Need help to stop this hack into FreeSwitch!<br>
<br>
Someone has gotten into my FreeSwitch, my firewall is set to only allow SIP traffic from my ITSP, and I added a rule to block the bad address but it did not work so I am baffled. It looks like 85.25.198.253 (Germany) is making a call to me and trying to call out. I would really appreciate any ideas on what kind of general FW rule to add to prevent this, I don't know what is going on. Next I'll run PCAPs. I was thinking of a rule to block all outgoing SIP traffic except to the ITSP. Would appreciate help, especially an explanation of what they are trying to do in FS.<br>
Mario G<br>
<br>
* Started May 19 8am, goes through all 7 sip accounts every 10 seconds<br>
* Each time it starts at extension 1000, goes through all 7 accounts, then waits 10 seconds, the extension is incremented by 1 and goes through all 7 accounts, this repeats until finally stopping at extension 9010, then starts at a different time of day hours later.<br>
<br>
* My account is itsp1 and itsp2, there are 5 more but I cut them out to reduce this.<br>
* 1.2.3.4 is my public wan address.<br>
* They look like 85.25.198.253, but blocking that in the FW does not help. Odd since I have done that before and it worked.<br>
* The "processing 4003 <4003>->+972592406392" is baffling.<br>
<br>
This is a short/reduced snippet from the log:<br>
2014-05-19 17:02:23.827470 [NOTICE] switch_channel.c:1054 New Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [2837a51d-b25d-4b42-9fd9-f5b772d93f70]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1052 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_NEW<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1052 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] sofia.c:8334 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> receiving invite from <a href="http://85.25.198.253:5074/" target="_blank">85.25.198.253:5074</a> version: 1.5.13b git 285e7dc 2014-05-19 17:38:09Z 64bit<br>
2014-05-19 17:02:23.827470 [DEBUG] sofia.c:6200 Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> entering state [received][100]<br>
2014-05-19 17:02:23.827470 [DEBUG] sofia.c:6210 Remote SDP:<br>
v=0<br>
o=sipcli-Session 1785091527 1239589188 IN IP4 85.25.198.253 s=sipcli c=IN IP4 85.25.198.253<br>
t=0 0<br>
m=audio 5075 RTP/AVP 18 0 8 101<br>
a=rtpmap:18 G729/8000<br>
a=rtpmap:0 PCMU/8000<br>
a=rtpmap:8 PCMA/8000<br>
a=rtpmap:101 telephone-event/8000<br>
a=fmtp:101 0-15<br>
a=ptime:20<br>
<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_media.c:3437 Audio Codec Compare [PCMA:8:8000:20:64000] ++++ is saved as a match<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_media.c:3383 Audio Codec Compare [PCMA:8:8000:20:64000]/[GSM:3:8000:20:13200]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_media.c:3309 Set telephone-event payload to 101<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_media.c:2343 Set Codec sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> PCMU/8000 20 ms 160 samples 64000 bits<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_codec.c:111 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Original read codec set to PCMU:0<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_media.c:3626 Set 2833 dtmf send/recv payload to 101<br>
2014-05-19 17:02:23.827470 [DEBUG] sofia.c:6485 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State Change CS_NEW -> CS_INIT<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:486 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State NEW<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_INIT<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:507 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State INIT<br>
2014-05-19 17:02:23.827470 [DEBUG] mod_sofia.c:87 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> SOFIA INIT<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:40 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard INIT<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:48 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State Change CS_INIT -> CS_ROUTING<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:507 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State INIT going to sleep<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_ROUTING<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_channel.c:2178 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Callstate Change DOWN -> RINGING<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:523 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State ROUTING<br>
2014-05-19 17:02:23.827470 [DEBUG] mod_sofia.c:123 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> SOFIA ROUTING<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:164 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard ROUTING<br>
2014-05-19 17:02:23.827470 [INFO] mod_dialplan_xml.c:558 Processing 4003 <4003>-><a href="tel:%2B972592406392" value="+972592406392">+972592406392</a> in context public<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> parsing [public->unloop] continue=false<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (PASS) [unloop] ${unroll_loops}(true) =~ /^true$/ break=on-false<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (FAIL) [unloop] ${sip_looped_call}() =~ /^true$/ break=on-false<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> parsing [public->outside_call] continue=true<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Absolute Condition [outside_call]<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Action set(outside_call=true)<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Action export(RFC2822_DATE=${strftime(%a, %d %b %Y %T %z)})<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> parsing [public->call_debug] continue=true<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (FAIL) [call_debug] ${call_debug}(false) =~ /^true$/ break=never<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> parsing [public->public_extensions] continue=false<br>
</div></div>Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (FAIL) [public_extensions] destination_number<a href="tel:%28%2B972592406392" value="+972592406392">(+972592406392</a>) =~ /^([1-2][0-1][0-3])$/ break=on-false .......... deleted lines<br>
<div class="HOEnZb"><div class="h5">Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (FAIL) [itsp1_did] destination_number<a href="tel:%28%2B972592406392" value="+972592406392">(+972592406392</a>) =~ /^(1212121212121)$/ break=on-false<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> parsing [public->itsp2_did] continue=false<br>
Dialplan: sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Regex (FAIL) [itsp2_did] destination_number<a href="tel:%28%2B972592406392" value="+972592406392">(+972592406392</a>) =~ /^(1313131313131)$/ break=on-false<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:214 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State Change CS_ROUTING -> CS_EXECUTE<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:523 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State ROUTING going to sleep<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_EXECUTE<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:530 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State EXECUTE<br>
2014-05-19 17:02:23.827470 [DEBUG] mod_sofia.c:178 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> SOFIA EXECUTE<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:256 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard EXECUTE EXECUTE sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> set(outside_call=true)<br>
2014-05-19 17:02:23.827470 [DEBUG] mod_dptools.c:1435 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> SET [outside_call]=[true] EXECUTE sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> export(RFC2822_DATE=Mon, 19 May 2014 17:02:23 -0700)<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_channel.c:1246 EXPORT (export_vars) [RFC2822_DATE]=[Mon, 19 May 2014 17:02:23 -0700]<br>
2014-05-19 17:02:23.827470 [NOTICE] switch_core_state_machine.c:313 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> has executed the last dialplan instruction, hanging up.<br>
2014-05-19 17:02:23.827470 [NOTICE] switch_core_state_machine.c:315 Hangup sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [CS_EXECUTE] [NORMAL_CLEARING]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_channel.c:3216 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [KILL]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:530 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State EXECUTE going to sleep<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_HANGUP<br>
2014-05-19 17:02:23.827470 [DEBUG] switch_core_state_machine.c:730 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Callstate Change RINGING -> HANGUP<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:732 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State HANGUP<br>
2014-05-19 17:02:23.846717 [DEBUG] mod_sofia.c:413 Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> hanging up, cause: NORMAL_CLEARING<br>
2014-05-19 17:02:23.846717 [DEBUG] mod_sofia.c:547 Responding to INVITE with: 480<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:58 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard HANGUP, cause: NORMAL_CLEARING<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:732 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State HANGUP going to sleep<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:499 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State Change CS_HANGUP -> CS_REPORTING<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_REPORTING<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:818 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State REPORTING<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:102 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard REPORTING, cause: NORMAL_CLEARING<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:818 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State REPORTING going to sleep<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:493 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State Change CS_REPORTING -> CS_DESTROY<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_session.c:1387 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_session.c:1604 Session 234 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Locked, Waiting on external entities<br>
2014-05-19 17:02:23.846717 [NOTICE] switch_core_session.c:1622 Session 234 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Ended<br>
2014-05-19 17:02:23.846717 [NOTICE] switch_core_session.c:1626 Close Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [CS_DESTROY]<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:618 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Callstate Change HANGUP -> DOWN<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:621 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_DESTROY<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:631 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State DESTROY<br>
2014-05-19 17:02:23.846717 [DEBUG] mod_sofia.c:323 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> SOFIA DESTROY<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:109 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> Standard DESTROY<br>
2014-05-19 17:02:23.846717 [DEBUG] switch_core_state_machine.c:631 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) State DESTROY going to sleep<br>
2014-05-19 17:02:25.107472 [NOTICE] switch_channel.c:1054 New Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [364bd3e4-2c4b-4412-b259-10cfb0b6c391]<br>
2014-05-19 17:02:25.107472 [DEBUG] switch_core_session.c:1052 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:25.107472 [DEBUG] switch_core_state_machine.c:467 (sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a>) Running State Change CS_NEW<br>
2014-05-19 17:02:25.107472 [DEBUG] switch_core_session.c:1052 Send signal sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> [BREAK]<br>
2014-05-19 17:02:25.107472 [DEBUG] sofia.c:8334 sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> receiving invite from <a href="http://85.25.198.253:5084/" target="_blank">85.25.198.253:5084</a> version: 1.5.13b git 285e7dc 2014-05-19 17:38:09Z 64bit<br>
2014-05-19 17:02:25.107472 [DEBUG] sofia.c:6200 Channel sofia/itsp1/<a href="mailto:4003@1.2.3.4">4003@1.2.3.4</a> entering state [received][100]<br>
2014-05-19 17:02:25.107472 [DEBUG] sofia.c:6210 Remote SDP:<br>
v=0<br>
o=sipcli-Session 17343503 <a href="tel:2124966596" value="+12124966596">2124966596</a> IN IP4 85.25.198.253 s=sipcli c=IN IP4 85.25.198.253<br>
t=0 0<br>
m=audio 5085 RTP/AVP 18 0 8 101<br>
a=rtpmap:18 G729/8000<br>
a=rtpmap:0 PCMU/8000<br>
a=rtpmap:8 PCMA/8000<br>
a=rtpmap:101 telephone-event/8000<br>
a=fmtp:101 0-15<br>
a=ptime:20<br>
<br>
2014-05-19 17:02:25.107472 [DEBUG] switch_core_media.c:3383 Audio Codec Compare [G729:18:8000:20:8000]/[G722:9:8000:20:64000]<br>
<br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com/" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server <a href="http://www.cudatel.com/" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org/" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org/" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com/" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org/" target="_blank">http://www.freeswitch.org</a><br>
<br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com/" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com/" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org/" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org/" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com/" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org/" target="_blank">http://www.freeswitch.org</a><br>
</div></div></blockquote></div><br></div>
_________________________________________________________________________<br>Professional FreeSWITCH Consulting Services:<br><a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>http://www.freeswitchsolutions.com<br><br>FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>http://www.cudatel.com<br><br>Official FreeSWITCH Sites<br>http://www.freeswitch.org<br>http://wiki.freeswitch.org<br>http://www.cluecon.com<br><br>FreeSWITCH-users mailing list<br>FreeSWITCH-users@lists.freeswitch.org<br>http://lists.freeswitch.org/mailman/listinfo/freeswitch-users<br>UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users<br>http://www.freeswitch.org<br></blockquote></div><br></div></div></body></html>