There are counter attacks for sipvicious, the author has intentionally left ways to counter strike... This is something that fail2ban and others are out there for... Building them into freeswitch itself would create even more overhead and probably couldn’t do as good of a job as a purpose build IDS
On 10/14/13 12:21 PM, "Martin Cmelik" <martin.cmelik@gmail.com> wrote:
Wouldnt be possible to have some IDS countermeasure and attack mitigation directly build in FS?
For example Snort have more than 100 signatures for SIP attacks, but Snort is resource intensive and also cant inspect encrypted traffic.
Thank you
S pozdravem / Best regards,
Martin Čmelík
Sent from
On 14. 10. 2013, at 18:59, Steven Ayre <steveayre@gmail.com> wrote:
Remember unless it gets blocked upstream the packet will still hit your firewall/server. Not FreeSWITCH sure, but it'll still consume some resources to receive, identify and block it. The scanner does not care that you're not responding, it'll continue to send anyway.
On 14 October 2013 15:57, Mimiko <vbvbrj@gmail.com> wrote:
On 14.10.2013 17:54, Ken Rice wrote:
> This is sipvicious, its a brute force scanner... See
> http://wiki.freeswitch.org/wiki/Fail2ban on how to setup Fail2ban with
> FreeSWITCH to defeat this attack
Ken thank you. I am planning to set up Fail2ban. But for now need to
drop any packet from offending IP.
--
Mimiko desu.
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users <http://lists.freeswitch.org/mailman/options/freeswitch-users>
http://www.freeswitch.org
_________________________________________________________________________
Professional FreeSWITCH Consulting Services:
consulting@freeswitch.org
http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server
http://www.cudatel.com
Official FreeSWITCH Sites
http://www.freeswitch.org
http://wiki.freeswitch.org
http://www.cluecon.com
FreeSWITCH-users mailing list
FreeSWITCH-users@lists.freeswitch.org
http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
http://www.freeswitch.org
--
Ken
http://www.FreeSWITCH.org
http://www.ClueCon.com
http://www.OSTAG.org
irc.freenode.net #freeswitch