August 2010 - FreeSWITCH-users - FreeSWITCH Mailing Lists

Gateway registration issue, can only be solved through "killgw"
by Roman_ 10 Aug '10

10 Aug '10

Hi all, I experienced an issue with gateway registration yesterday, where the registration first failed with a "Request Timeout (408)" error and after that it kept failing with "Bad Request (400)". It kept retrying periodically with increasing delays in between, but even after almost 24 hours the registration still failed (and with delays of about 40 minutes between attempts). Only then did I notice that the gateway had failed, and restarting the gateway ("killgw" then "rescan") immediately solved the problem and the gateway registered successfully. This is part of the log: 2010-08-08 16:31:30.464055 [ERR] sofia_reg.c:1502 gateyway.com Registration Failed with status Request Timeout [408]. failure #1 2010-08-08 16:31:35.444058 [WARNING] sofia_reg.c:387 gateway.com Failed Registration, setting retry to 60 seconds. 2010-08-08 16:32:54.674056 [NOTICE] sofia_reg.c:342 Registering gateway.com 2010-08-08 16:32:54.744052 [ERR] sofia_reg.c:1502 gateway.com Registration Failed with status Bad Request [400]. failure #2 2010-08-08 16:33:04.614052 [WARNING] sofia_reg.c:387 gateway.com Failed Registration, setting retry to 90 seconds. this then continued for almost 24 hours before I noticed it, always with error code 400. Now, what worries me about this is that the gateway stopped working, but was not able to recover from the problem by itself. Only manual intervention by restarting the gateway solved the issue. Is there any way I can make sure that the gateway does not get stuck like this and can recover by itself? Does the fact that it did not recover by itself not suggest that there might be a bug in Freeswitch when registration fails, which prevents a successful registration until one manually kills and restarts the gateway? I am using the Freeswitch version from the master branch of the git repository, compiled on July 19. Any help is appreciated, thanks. Best regards, Roman -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Gateway-registration-issue-ca… Sent from the freeswitch-users mailing list archive at Nabble.com.

3 4

Re: [Freeswitch-users] we are under attack
by Bernhard Suttner 10 Aug '10

10 Aug '10

Hi, wouldnt it be a good task for freeswitch, to detect registerspoofing and call a hook (maybe a script) which than could close the firewall?Or that freeswitch will just ignore any request from the given IP for a acertain time. I tried to find a good application/script to prevent registerspoofing but the only thing was the fail2ban script. Couldnt freeswitch justspeak directly with the firewall and drop these requests J ? Best regards, Bernhard Von:freeswitch-users-bounces@lists.freeswitch.org[mailto:freeswitch-users-bounces@lists.freeswitch.org] Im Auftrag von KristianKielhofner Gesendet: Dienstag, 10. August 2010 02:05 An: freeswitch-users(a)lists.freeswitch.org Betreff: Re: [Freeswitch-users] we are under attack Oh yeah, that was it :). I leave default to accept and add my owndrop everything at the end. -- Kristian Kielhofner http://blog.krisk.org From: freeswitch-users-bounces(a)lists.freeswitch.org<freeswitch-users-bounces(a)lists.freeswitch.org> To: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org> Sent: Mon Aug 09 19:55:53 2010 Subject: Re: [Freeswitch-users] we are under attack with your permission ill probably copy the script to the FSwiki, and attribute it with links to the other locations. ( that way we dont rely on a 3rd party site to stay up ) as for the issue with STOP... .. i removes all rules :) and if you have the default set to drop all incoming, then.. well your stuffed.. STOP should just back out the rules that the script added,not remove everything J On Tue, Aug 10, 2010 at 12:23 AM, Kristian Kielhofner <kris(a)kriskinc.com> wrote: The current version of the script and a littlebackground can be found here: http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html I have no problem linking the FS wiki to either of these but the eTel wiki will probably get taken down eventually. As far as the issue with the stop command... I remember us talking about it but I don't remember the specific problem. Care to refresh my memory?

1 0

Re: [Freeswitch-users] Question about SIP security
by Hristo Benev 10 Aug '10

10 Aug '10

I also see a lot of attempts to connect to 5060, but it looks like a botnet since I never have more than 1 form 1 IP - Here fail2ban is helpless since attempts per IP limit is never reached. >-------- Оригинално писмо -------- >От: Patrick Lists >Относно: Re: [Freeswitch-users] Question about SIP security >До: FreeSWITCH Users Help >Изпратено на: Петък, 2010, Юли 30 20:54:49 EEST >On 07/30/2010 05:56 PM, Mike van Lammeren wrote: >[snip] >> This is probably not the forum for it, but anyone reading this might >> want to check their traffic for this IP: 61.164.41.144 > >Hi Mike, > >I see something similar although not from the same IP address. For weeks >now I get a lot of SIP connections all from China. The easiest solution >(for me) was to install fail2ban, configure, fire and forget. Kinda fun >to watch them get blocked if y're bored :) > >Regards, >Patrick > >_______________________________________________ >FreeSWITCH-users mailing list >FreeSWITCH-users(a)lists.freeswitch.org >http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >http://www.freeswitch.org >

3 2

Calling internal extensions to/from outside is acting strange
by Tae-Sung Shin 10 Aug '10

10 Aug '10

Hello Guys First of all, I am a new user of Freeswitch. I spent a couple of days on this issue and am desperate for some help. Briefly, my problems are 1. Calling out from SPA2102 (ext 1002) or a softphone (phonerlite) (ext 1003) via gateway voip is disconnected as soon as it got answered after ringing in the other side. 2. Calling from outside is disconnected 30 seconds after it got answered. I don't have this problem with calls between the internal extensions. Without extensions (direct communication between gateway and SPA2102), I verified SPA2102 is working fine My environment: <PSTN outside> --- <Freeswitch> --- <my extensions> As Freeswitch wiki, suggested, I have following xml contents . Sip_profiles/external/voipms.xml <include> <gateway name="sip.atlanta.voip.ms"> <param name="username" value="XXXXXXX" /> <param name="password" value="XXXXXXXXX" /> <param name="register" value="true" /> <param name="expire-seconds" value="60"/> <param name="register-transport" value="udp"/> <param name="retry-seconds" value="100"/> </gateway> </include> . Dialplan/public/voipms.xml <include> <extension name="AllOutbound"> <condition field="network_addr" expression="^192\.168\.0\.11[2-7]$"/> <condition field="destination_number" expression="^1?(\d{10})$"> <action application="set" data="effective_caller_id_number=XXXXXXX"/> <action application="set" data="effective_caller_id_name=XXXXXXX"/> <action application="bridge" data="sofia/gateway/sip.atlanta.voip.ms/$1"/> </condition> </extension> <extension name="Inbound_mss"> <condition field="destination_number" expression="^5555555555$"> <action application="bridge" data="sofia/internal/1002@192.168.0.114:5060"/> </condition> </extension> <extension name="Inbound_pstn"> <condition field="destination_number" expression="^1002$"> <action application="bridge" data="sofia/internal/1002@192.168.0.114:5060"/> </condition> </extension> <extension name="Inbound_sipphone"> <condition field="destination_number" expression="^1003$"> <action application="bridge" data="sofia/internal/@1003@192.168.0.117:5060"/> </condition> </extension> </include> I think I went through all wiki and other articles on the web but could find a resolution for this issue. I would appreciate if you give me any hint. Thanks Tae-Sung Shin

1 1

Example 15: Speaking Clock
by mazilo 10 Aug '10

10 Aug '10

Has anyone managed to implement the Example 15: Speaking Clock as shown http://wiki.freeswitch.org/wiki/Dialplan_XML here ? If so, I am puzzled as where to put the XML file? Also, in this example, it references to http://wiki.freeswitch.org/wiki/Mod_flite mod_flite and where would I put this mod_flite file? I put these two files under conf/dialplan/public directory. Then, what number should I dial to reach this Speaking Clock? ----- don't and stop are the ONLY two 4-letter words considered offensive to men, but not when used together. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/Example-15-Speaking-Clock-tp5… Sent from the freeswitch-users mailing list archive at Nabble.com.

2 2

Re: [Freeswitch-users] ACLs through proxy
by jprsa 10 Aug '10

10 Aug '10

Hello, Were you able to finally get your UAs to register on your FS boxes behind the proxy (opensip) server? Thanks Bill W-3 wrote: > > That's fantastic! FreeSWITCH ROCKS! > > I'll update the wiki. > > Thanks, > Bill > > > > Brian West wrote: >> use "apply-proxy-acl" on the sofia profile. >> >> /b >> >> On Dec 15, 2009, at 10:58 PM, Bill W wrote: >> >>> However, having the proxy in the path effectively negates using IP >>> based >>> ACLS. >> >> >> _______________________________________________ >> FreeSWITCH-users mailing list >> FreeSWITCH-users(a)lists.freeswitch.org >> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users >> http://www.freeswitch.org > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org > > -- View this message in context: http://old.nabble.com/ACLs-through-proxy-tp26806529p29331510.html Sent from the Freeswitch-users mailing list archive at Nabble.com.

3 2

Re: [Freeswitch-users] we are under attack
by Kristian Kielhofner 10 Aug '10

10 Aug '10

Oh yeah, that was it :). I leave default to accept and add my own drop everything at the end. -- Kristian Kielhofner http://blog.krisk.org ------------------------------ *From*: freeswitch-users-bounces(a)lists.freeswitch.org < freeswitch-users-bounces(a)lists.freeswitch.org> *To*: FreeSWITCH Users Help <freeswitch-users(a)lists.freeswitch.org> *Sent*: Mon Aug 09 19:55:53 2010 *Subject*: Re: [Freeswitch-users] we are under attack with your permission ill probably copy the script to the FS wiki, and attribute it with links to the other locations. ( that way we dont rely on a 3rd party site to stay up ) as for the issue with STOP... .. i removes all rules :) and if you have the default set to drop all incoming, then .. well your stuffed.. STOP should just back out the rules that the script added, not remove everything J On Tue, Aug 10, 2010 at 12:23 AM, Kristian Kielhofner <kris(a)kriskinc.com>wrote: > The current version of the script and a little background can be found > here: > > http://blog.krisk.org/2008/07/sip-dosddos-mitigation.html > > I have no problem linking the FS wiki to either of these but the > eTel wiki will probably get taken down eventually. > > As far as the issue with the stop command... I remember us talking > about it but I don't remember the specific problem. Care to refresh > my memory? > >

1 0

we are under attack
by Seven Du 09 Aug '10

09 Aug '10

Hi, We suffered an SIP attack from 67.23.236.75. It attempted to register to our SIP server using bruce force. We are running FS on a PC as our office PBX. When all phone failed, we noticed a high CPU load with 90%+ waiting or nice, and in the meantime it used up memory and start swapping to disk. It's a cheap PC with only 700MB memory, and we are running FS, DB, Rails and other system on it. So it took me some time to check every part. And it didn't help even I did a full server reboot. Finally I turned on sip trace in FS and found thousands and millions of illegal registers. And then I blocked the IP in iptables. During the hard time, I noticed: 1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ? 2) CPU also waiting page swap when used up memory. 3) After I dropped all packets from that IP, FS still kept sending register error sip messages for quite a long time before I restarted FS. Now looking to add http://wiki.freeswitch.org/wiki/Fail2ban, hope this helps . Hope this helps if some one also suffered this. 7. -- Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn

6 6

Asterisk to Freeswitch
by Michael Gende 09 Aug '10

09 Aug '10

Hello, I was wondering if someone could please give me a shove in the right direction concerning some "translations". I've got some dial plan examples for a vendor's handset that are created for Asterisk. Naturally, we use FreeSwitch. Any "dial plan translation" pages to be found? I found the Rosetta Stone on the FS site. Very comprehensive, but I didn't see things for the commands in my examples (i.e, Asterisk's Pickup = FS command X) I'll figure it out but wondered if someone else had already been down this road. Regards, Mike G. P.S. Nice new FS book, by the way. Got our copy last week, very instructive and a good read to boot.

2 1

Video Support
by John Hermanski 09 Aug '10

09 Aug '10

Hi Samuel, Well, I guess you could, but as it's a Freeswitch client that is specifically designed to work with a Diastar server, it would be kind of pointless. The "server" is all software and runs on a moderately powerful PC. So, if you have a PC with a decent multicore CPU and 1 GB of memory, you can download the server software, get a trial license (http://www.dialogic.com/technologies/open-source/diastar.htm?regID=38692) and start working with mod_woomera. We distribute the software as a bootable ISO that self-installs - CentOS included - quite easily. It will, however, overwrite your disk drive. John Hermanski Technical Marketing Engineer Dialogic This e-mail is intended only for the named recipient(s) and may contain information that is privileged, confidential and/or exempt from disclosure under applicable law. No waiver of privilege, confidence or otherwise is intended by virtue of communication via the internet. Any unauthorized use, dissemination or copying is strictly prohibited. If you have received this e-mail in error, or are not named as a recipient, please immediately notify the sender and destroy all copies of this e-mail.

1 0