On 14.10.2013 20:55, Ken Rice wrote:
There are counter attacks for sipvicious, the author has intentionally left ways to counter strike... This is something that fail2ban and others are out there for... Building them into freeswitch itself would create even more overhead and probably couldn’t do as good of a job as a purpose build IDS
Fail2ban must be apart from FS, as it can be used to monitor other services hosted on same machine. Even SSH server. Although the attacker's IP was blocked I still see in logs: Where is sofia/internal_A.B.C.D/100@A.B.C.D appears? 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.690475 [NOTICE] switch_channel.c:1034 New Channel sofia/internal_A.B.C.D/100@A.B.C.D [35a84dc8-0a11-449a-9a81-aa0a6ad75ab6] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.690475 [DEBUG] switch_core_session.c:1010 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.690475 [DEBUG] switch_core_session.c:1010 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.690475 [DEBUG] switch_core_state_machine.c:418 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_NEW 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.690475 [DEBUG] switch_core_state_machine.c:436 (sofia/internal_A.B.C.D/100@A.B.C.D) State NEW 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:48:51.810383 [DEBUG] switch_core_session.c:1010 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 2013-10-14 20:48:51.810383 [DEBUG] sofia.c:1787 detaching session 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [WARNING] switch_core_state_machine.c:517 9ed841f1-b75d-4462-b8c4-100b976d3567 sofia/internal_A.B.C.D/100@A.B.C.D Abandoned 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [NOTICE] switch_core_state_machine.c:520 Hangup sofia/internal_A.B.C.D/100@A.B.C.D [CS_NEW] [WRONG_CALL_STATE] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_channel.c:3139 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [KILL] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:418 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_HANGUP 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:681 (sofia/internal_A.B.C.D/100@A.B.C.D) State HANGUP 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] mod_sofia.c:465 Channel sofia/internal_A.B.C.D/100@A.B.C.D hanging up, cause: WRONG_CALL_STATE 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:48 sofia/internal_A.B.C.D/100@A.B.C.D Standard HANGUP, cause: WRONG_CALL_STATE 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:681 (sofia/internal_A.B.C.D/100@A.B.C.D) State HANGUP going to sleep 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:694 (sofia/internal_A.B.C.D/100@A.B.C.D) Callstate Change DOWN -> HANGUP 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:449 (sofia/internal_A.B.C.D/100@A.B.C.D) State Change CS_HANGUP -> CS_REPORTING 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:418 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_REPORTING 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:766 (sofia/internal_A.B.C.D/100@A.B.C.D) State REPORTING 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:92 sofia/internal_A.B.C.D/100@A.B.C.D Standard REPORTING, cause: WRONG_CALL_STATE 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:766 (sofia/internal_A.B.C.D/100@A.B.C.D) State REPORTING going to sleep 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:443 (sofia/internal_A.B.C.D/100@A.B.C.D) State Change CS_REPORTING -> CS_DESTROY 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_session.c:1553 Session 85 (sofia/internal_A.B.C.D/100@A.B.C.D) Locked, Waiting on external entities 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [NOTICE] switch_core_session.c:1571 Session 85 (sofia/internal_A.B.C.D/100@A.B.C.D) Ended 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [NOTICE] switch_core_session.c:1575 Close Channel sofia/internal_A.B.C.D/100@A.B.C.D [CS_DESTROY] 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:568 (sofia/internal_A.B.C.D/100@A.B.C.D) Callstate Change HANGUP -> DOWN 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:571 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_DESTROY 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:581 (sofia/internal_A.B.C.D/100@A.B.C.D) State DESTROY 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] mod_sofia.c:375 sofia/internal_A.B.C.D/100@A.B.C.D SOFIA DESTROY 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:99 sofia/internal_A.B.C.D/100@A.B.C.D Standard DESTROY 9ed841f1-b75d-4462-b8c4-100b976d3567 2013-10-14 20:48:56.370468 [DEBUG] switch_core_state_machine.c:581 (sofia/internal_A.B.C.D/100@A.B.C.D) State DESTROY going to sleep 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [WARNING] switch_core_state_machine.c:517 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 sofia/internal_A.B.C.D/100@A.B.C.D Abandoned 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [NOTICE] switch_core_state_machine.c:520 Hangup sofia/internal_A.B.C.D/100@A.B.C.D [CS_NEW] [WRONG_CALL_STATE] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_channel.c:3139 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [KILL] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:418 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_HANGUP 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:681 (sofia/internal_A.B.C.D/100@A.B.C.D) State HANGUP 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] mod_sofia.c:465 Channel sofia/internal_A.B.C.D/100@A.B.C.D hanging up, cause: WRONG_CALL_STATE 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:48 sofia/internal_A.B.C.D/100@A.B.C.D Standard HANGUP, cause: WRONG_CALL_STATE 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:681 (sofia/internal_A.B.C.D/100@A.B.C.D) State HANGUP going to sleep 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:694 (sofia/internal_A.B.C.D/100@A.B.C.D) Callstate Change DOWN -> HANGUP 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:449 (sofia/internal_A.B.C.D/100@A.B.C.D) State Change CS_HANGUP -> CS_REPORTING 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:418 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_REPORTING 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:766 (sofia/internal_A.B.C.D/100@A.B.C.D) State REPORTING 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:92 sofia/internal_A.B.C.D/100@A.B.C.D Standard REPORTING, cause: WRONG_CALL_STATE 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:766 (sofia/internal_A.B.C.D/100@A.B.C.D) State REPORTING going to sleep 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:443 (sofia/internal_A.B.C.D/100@A.B.C.D) State Change CS_REPORTING -> CS_DESTROY 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_session.c:1345 Send signal sofia/internal_A.B.C.D/100@A.B.C.D [BREAK] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_session.c:1553 Session 86 (sofia/internal_A.B.C.D/100@A.B.C.D) Locked, Waiting on external entities 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [NOTICE] switch_core_session.c:1571 Session 86 (sofia/internal_A.B.C.D/100@A.B.C.D) Ended 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [NOTICE] switch_core_session.c:1575 Close Channel sofia/internal_A.B.C.D/100@A.B.C.D [CS_DESTROY] 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:568 (sofia/internal_A.B.C.D/100@A.B.C.D) Callstate Change HANGUP -> DOWN 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:571 (sofia/internal_A.B.C.D/100@A.B.C.D) Running State Change CS_DESTROY 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:581 (sofia/internal_A.B.C.D/100@A.B.C.D) State DESTROY 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] mod_sofia.c:375 sofia/internal_A.B.C.D/100@A.B.C.D SOFIA DESTROY 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:99 sofia/internal_A.B.C.D/100@A.B.C.D Standard DESTROY 35a84dc8-0a11-449a-9a81-aa0a6ad75ab6 2013-10-14 20:49:01.830470 [DEBUG] switch_core_state_machine.c:581 (sofia/internal_A.B.C.D/100@A.B.C.D) State DESTROY going to sleep -- Mimiko desu.