I had a similar problem a couple of weeks ago. I was hit from IP's in China and Finland. In the end I created an iptables chain to just allow Australian IP's only as we only expect to see Australian IP's, I obtained the list from http://www.ipaddresslocation.org. Then I create a log rule to log any drop connections to /var/log/messages and use nagios check_log to email me if there are any drops, this way I can be sure its only Australian IP's. I also added some rate limiting to ports 5060-5080. To date we have not had anymore issues... Touch wood!. On 09/08/2010, at 11:24 AM, Seven Du wrote:
Hi,
We suffered an SIP attack from 67.23.236.75. It attempted to register to our SIP server using bruce force.
We are running FS on a PC as our office PBX. When all phone failed, we noticed a high CPU load with 90%+ waiting or nice, and in the meantime it used up memory and start swapping to disk.
It's a cheap PC with only 700MB memory, and we are running FS, DB, Rails and other system on it. So it took me some time to check every part. And it didn't help even I did a full server reboot. Finally I turned on sip trace in FS and found thousands and millions of illegal registers. And then I blocked the IP in iptables.
During the hard time, I noticed:
1) It stucks on one CPU even I have 2 core since sofia-sip is single threaded ?
2) CPU also waiting page swap when used up memory.
3) After I dropped all packets from that IP, FS still kept sending register error sip messages for quite a long time before I restarted FS.
Now looking to add http://wiki.freeswitch.org/wiki/Fail2ban, hope this helps .
Hope this helps if some one also suffered this.
7.
-- Blog: http://www.dujinfang.com Proj: http://www.freeswitch.org.cn
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org