<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Looks like sip scanners trying to own your system. You can turn on sip trace to see more. Fail2ban is maybe useful for this.<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Aug 21, 2018, at 5:37 AM, Jose David Jurado Alonso <<a href="mailto:josedavid@zennio.com" class="">josedavid@zennio.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Hi,<br class=""><br class=""><br class="">I'm just observing in the log that user 1001 (and other random users like '55340115419480247') is continuously creating and closing channels.<br class=""><br class="">That users doesn't exist (I delete the folder "directory" since I use database with different user names, no numbers).<br class=""><br class="">I've done a search some reference to user 1001 in all the configuration and haven't found anything (using "grep -r '1001' /etc/freeswitch/*")<br class=""><br class="">Any idea why this happens? A bot or spider maybe?<div class=""><br class=""></div><div class=""><br class=""><br class="">Log trace example:<br class=""><br class=""></div><div class=""><div class="">2018-08-21 09:34:50.448541 [WARNING] switch_core_state_machine.c:687 1f89de01-b82f-44fa-9b91-9d111c44e220 sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> Abandoned</div><div class="">2018-08-21 09:34:50.448541 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [CS_NEW] [WRONG_CALL_STATE]</div><div class="">2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1731 Session 291 (sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a>) Ended</div><div class="">2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [CS_DESTROY]</div><div class="">2018-08-21 09:34:51.288542 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [f8be20e3-1244-48bb-a89b-7b49382726af]</div><div class="">2018-08-21 09:34:52.568543 [WARNING] switch_core_state_machine.c:687 bae7044c-4915-4a9a-9265-6e48e969ffec sofia/internal/<a href="mailto:55340115419480247@192.168.1.120" class="">55340115419480247@192.168.1.120</a> Abandoned</div><div class="">2018-08-21 09:34:52.568543 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/<a href="mailto:55340115419480247@192.168.1.120" class="">55340115419480247@192.168.1.120</a> [CS_NEW] [WRONG_CALL_STATE]</div><div class="">2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1731 Session 292 (sofia/internal/<a href="mailto:55340115419480247@192.168.1.120" class="">55340115419480247@192.168.1.120</a>) Ended</div><div class="">2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/<a href="mailto:55340115419480247@192.168.1.120" class="">55340115419480247@192.168.1.120</a> [CS_DESTROY]</div><div class="">2018-08-21 09:34:52.848563 [WARNING] switch_core_state_machine.c:687 a0a39ab8-f109-468b-8136-3ebf044c2ffd sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> Abandoned</div><div class="">2018-08-21 09:34:52.848563 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [CS_NEW] [WRONG_CALL_STATE]</div><div class="">2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1731 Session 293 (sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a>) Ended</div><div class="">2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [CS_DESTROY]</div><div class="">2018-08-21 09:34:54.248541 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> [ef2d84f4-89e5-453d-89df-8280b129b42b]</div><div class="">2018-08-21 09:34:55.148543 [WARNING] switch_core_state_machine.c:687 9f1804f2-80d0-4fad-8e43-40f0cf2777e9 sofia/internal/<a href="mailto:1001@192.168.1.120" class="">1001@192.168.1.120</a> Abandoned</div></div></div></div></blockquote></div><br class=""></body></html>