Could be less sinister. If you are bridging calls and the remote ip stops responding, fs can get backed up with calls, show channels will take forever and even trying to tab out commands will take some time. You can confirm if this is the case by opening core.db in sqlite3 and issue a command something like "select * from channels". If it is a back log, you can delete the channels from sqlite (delete from ... Where ..), you also need to delete from calls. I'm not 100% is its safe to do so though, but it's worked for me in the past. Bridging to a gateway rather than ip will help if this is the issue. The other thing I've seen cause what you describe is a bunged up ip tables (lots and lots of ruled from automated blocking) Have a look at iptables -L -n (I think that's right), and if lots of old rules, try restarting iptables. If it is a dos attack then as many have said, fail2ban is the way to go - though you should have that installed anyway. The simplest way to check if you are under attack is to install wireshark and issue: tethereal port 5060. Thanks Oz
On 26 Jun 2015, at 18:31, Stanislav Sinyagin <ssinyagin@gmail.com> wrote:
But do you see an excessive amount of SIP messages coming to your server?
On Jun 26, 2015 6:22 PM, "Eric Ni" <xyangni@gmail.com> wrote: Thanks. I have tried this. But today it happen again. When I killed freeswith process and restart it, everything back to normal. So it does seem to be a DOS attack now. Or restarting fs won't make any difference.
On Sat, Jun 13, 2015 at 1:04 AM, Stanislav Sinyagin <ssinyagin@gmail.com> wrote: here are iptables rules which do a simple rate limiting for SIP messages, probably this helps: https://txlab.wordpress.com/2013/06/29/protecting-a-vpbx-from-dos-attacks/
On Sat, Jun 13, 2015 at 1:46 AM, Eric Ni <xyangni@gmail.com> wrote:
Hi,
I am using FreeSWITCH Version 1.4.18+git~20150312T185523Z~4eed221b69~64bit (git 4eed221 2015-03-12 18:55:23Z 64bit) on ubuntu 14.04, Linode VPS. It has been working fine for about 2 months. But recently it stopped working with CPU rate above 95% for several times. SIP client got 408 timeout error. I have to login system to kill the process and start over again. Then it back to normal for a period. Checked the log file, it seem to be a sudden stop. Nothing special before the stop and completely no log starting from the issue. May I ask how I should handle this issue? Thanks.
Regards, Eric
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
Official FreeSWITCH Sites http://www.freeswitch.org http://confluence.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org