- FreeSWITCH-users - FreeSWITCH Mailing Lists

(no subject)
by Essobi 21 Feb '11

21 Feb '11

http://hiawatha-von-hesperus.com/cool01.11.php?ID=731

2 2

Re: [Freeswitch-users] INVITE DoS Prevention
by Spencer Thomason 21 Feb '11

21 Feb '11

Hi Régis, We currently use openvz. Previously we used Xen and then BSD jails. Every one has their ups and downs. As many people will tell you, timing is critical in VoIP applications and by using OpenVZ there is only one kernel loaded and the VMs all run bare metal. This is a much more efficient way of running several VMs if they are all of a similar OS because you don't need to waste a bunch of RAM and CPU cycles just loading 30 copied of the kernel into memory and dealing with paging etc.. Also this makes administration much easier because of separate filesystems for each VM, the root of each VM is located somewhere in the host's filesystem. This is a big plus when you go to back up your hardware node. What we do is put all the VMs on an LVM partition, make a snapshot and use rsync to back up just the changes. It was a major pain with several independent LVM partitions or "virtual" file based partitions in Xen. KVM or any true virt platform would require the same, a dedicated partition for each VM. And CPU scaling works well with openvz allowing us to save on the electric bill and cooling costs. The downside is if there is a kernel panic, its one kernel and the whole world goes with it. BSD Jails was cool but didn't allow the per client resource control we were looking for. Our experience with openvz has been solid with a couple of machines up well over a year. We currently use Centos but we've modified it to the point where its basically our own in house distro with updates to some of the core packages since RH stays so far behind. (for good measure :-)) This allows us to pick and choose which packages we'd like to update and we make available our own repo which a simple yum update pulls down everything from a local mirror. If you are interested: http://repo.5ninesolutions.com . Having said that, there is a lot of time that goes into maintaining some of the out of distro stuff so we are currently looking at something that stays a little more current.. I.e. RH 6 has been out since Nov and I haven't seen a beta for Centos 6.. but thats a whole can of worms.. Spencer On Feb 20, 2011, at 11:35 PM, Régis MARTIN wrote: > Hi Spencer, > > >We run hosted Freeswitch instances in VMs > Nothing related with your question, but can you say me what > hypervisor do you use to run freeswitch virtualized (VMware ? KVM ? > Xen? OpenVZ ? other .. ?). ? > What's is your linux distrib under too ? > > I'm looking to virtualize some of mine under KVM and I wonder if it > works like standard host and looking to similar experience. > > Thanks in advance if you could confirm that to me. > > Regards, > > > 2011/2/21 Spencer Thomason <spencer(a)5ninesolutions.com> > Hi, > We run hosted Freeswitch instances in VMs with the internal profile on > port 5060 connecting to clients mostly behind NAT and then the > external profile connecting to our proxies only. Protecting the > external profile its straightforward.. we only allow traffic to/from > our proxies at the firewall level. But protecting the internal > profile seems to be a bit more difficult because the UACs could be > theoretically anywhere on the network. > > I'm currently using Fail2Ban to prevent brute force registration and > INVITEs on auth failures, e.g.: > failregex = \[WARNING\] sofia_reg.c:\d+ SIP auth failure $REGISTER$ > on sofia profile \'\w+\' for \[.*\] from ip <HOST> > \[WARNING\] sofia_reg.c:\d+ SIP auth failure $INVITE$ > on sofia profile \'\w+\' for \[.*\] from ip <HOST> > > My question is, since its part of a normal SIP dialog to challenge the > INVITE, is there any way to prevent a possible DoS from just sheer > volume of incoming INVITEs on an Internet facing server > automatically. I.e., If you block the logged challenge, you'd block > all legitimate INVITEs and registrations. Since its UDP traffic I > couldn't come up with a way to do it automatically at the iptables > level. i.e. number of concurrent connections. Is there some option to > just not respond if a client is sending a number of requests over a > certain threshold? It might not stop them from sending the traffic > but pretty soon they'd get the idea that it wasn't going to go > anywhere. My concern is say there are 50 Freeswitch instances on a > box (albeit 8 core, 32GB ram, 8 15K raid 10 storage) and someone > starts sending thousands of rouge INVITEs to every VM on a physical > box that the CPU load from just challenging the incoming INVITEs would > create a DoS. We the logs regularly to try to catch people doing this > sort of thing and drop them at a router upstream of the core network, > but I'd like to have it happen without human intervention. Have I > completely over thought this and am missing something obvious? > > Thanks, > Spencer > > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users(a)lists.freeswitch.org > http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users > http://www.freeswitch.org >

1 0

core dump in debian
by envelopes envelopes 21 Feb '11

21 Feb '11

#0 vxprintf (arg=0x40ac9be0, fmt=0x40249412 "q'", ap=<value optimized out>, useExtended=<value optimized out>, func=<value optimized out>) at src/switch_mprintf.c:686 #1 0x40130774 in base_vprintf (xRealloc=0x4012f328 <printf_realloc>, zInitBuf=0xb <Address 0xb out of bounds>, nInitBuf=<value optimized out>, zFormat=0xa <Address 0xa out of bounds>, ap=..., useInternal=<value optimized out>) at src/switch_mprintf.c:849 #2 0x40130880 in switch_mprintf (zFormat=0x4027671c "debian") at src/switch_mprintf.c:892 #3 0x4013ba48 in switch_core_expire_registration (force=0) at src/switch_core_sqldb.c:1726 #4 0x4013bf3c in switch_core_sql_db_thread (thread=<value optimized out>, obj=0x0) at src/switch_core_sqldb.c:926 #5 0x401c93dc in dummy_worker (opaque=0x402493d4) at threadproc/unix/thread.c:138 #6 0x402e48cc in start_thread () from /lib/libpthread.so.0 #7 0x4058bbdc in clone () from /lib/libc.so.6 #8 0x4058bbdc in clone () from /lib/libc.so.6 FS crashed right after start!

3 4

"Sofia SIP stack may stop responding"
by André Luiz dos Santos 21 Feb '11

21 Feb '11

>From http://wiki.freeswitch.org/wiki/Sofia: "Sometimes, in extremely rare edge cases, the Sofia SIP stack may stop responding. ..." Is there more documentation on this? Specifically, is there something I should avoid doing to lower my chances of hitting those rare edge cases?

1 0

cdr fields
by Serge Yuriev 21 Feb '11

21 Feb '11

Hello I noticed difference in cause codes written in csv CDR and RADIUS. Perhaps I need to change something in template? Current template is <template name="lanbilling"> ${direction},${sip_network_ip},${user_name},${caller_id_number},${destination_number},${start_stamp},${answer_stamp},${end_stamp},${billsec},${hangup_cause_q850},${hangup_cause},${uuid},${bleg_uuid},${accountcode},${read_codec},${write_codec} </template> This writes inbound,109.173.67.229,nevian,nevian,79645835822,2011-02-09 00:18:52,,2011-02-09 00:20:00,0,16,NORMAL_CLEARING,a4da79c4-5356-43b8-894b-78627fb5e243,,nevian,G729,G729 As you can see cause is 16 but in RADiUS is 27 and it's more accurate In mod_radius_cdr cause got from switch_channel_get_cause(channel) Please advice. -- wbr, Serge

3 3

Need help with CDR setup and call routing patterns
by Hareem Haque 20 Feb '11

20 Feb '11

Thank you very much for helping me out with the initial switch setup. I really appreciate it. However, I am stuck with the cdr and call routing patterns setup. A. I have attached my cdr_csv file and its cdr log file. As you may see in the conf xml that i have 22 items that i need posted onto my cdr logs. However, the csv file only shows 15 items. How can i make this work B. I have setup a few sip trunks. Now how do i set them up so that if i dial 01192 that call goes to gateway A and if i dial 1XXX then that call goes to gateway B Many thanks for all the help. I really appreciate it Best Regards Hareem. Haque

2 2

Any experience with DTMF from FreeSwitch to Sonus with Vega ATAs?
by Yehavi Bourvine 20 Feb '11

20 Feb '11

Hello, Anyone has an experience with the above configuration? All sides are marked as RFC-2833 and the Sonus recognises most of the DTMF's twice. The Vega sends both RFC-2833 events and about 60msec of the DTMF tone (according to Vega's engineers it takes it about 60 msec to detect the DTMF tones). According to the RFC this is acceptable. The service provider I am working with says that it shouldn't be like that. Before I waste time in wars, has anybody had this issue and knows whether it is a matter of configuration at the Sonus side? Thanks! __Yehavi:

3 5

Codec negotiation, again
by Serge Yuriev 20 Feb '11

20 Feb '11

Hello, A offers g729, g711a, g711u FS allows all of them B offers g711a, g711u Call fails with INCOMPATIBLE DESTINATION. Cant understand why FS offers only ONE codec (g729) to B - wiki says it should offer ordered LIST of.. GIT few days old, default config -- wbr, Serge

2 1

How to reread GW config?
by Serge Yuriev 20 Feb '11

20 Feb '11

Hello, I have changed few parameters on gw xml. reloadxml - no success sofia profile external rescan - no success sofia profile external register <gw> - no success sofia profile external restart - made things work I think it's too hard to restart profile for committing configs.. I'm doing something wrong? -- wbr, Serge

3 2

Mod_callcenter and Multi-Tenancy
by lloyd thomas 20 Feb '11

20 Feb '11

Hi, Can mod_callcenter be used in a multi-tenancy enviroment and with mod_xml_curl? Can you clarify what the following line means (Whether Multi-Tenancy or Multiple FS servers)?

1 0