That's be within the Sofia stack and it had to acknowledge the INVITE with a 100 Trying otherwise the INVITE either resends or gives up the same as a packet drop. Sleeping would mean keeping the INVITE in memory for longer while starting the session before accepting/rejecting it, increasing memory usage under a DOS attack and therefore making FS fall over faster. It'd also increase the complexity of the code starting up a session while it puts new invites aside and schedules them to be processed shortly afterwards. You couldn't just do a sleep as it'd probably lock Sofia up. Doesn't seem worth it. Iptables is a much better way of handling it. You can rate limit per-host. -Steve On 23 February 2011 15:10, mazilo <Nabble@slickdeals.endjunk.com> wrote:
jay binks wrote:
as for rate-limiting responses you can have iptables drop packets over X number of invites per sec ... Just a thought. Perhaps, we should contemplate to add a feature on FS to set maximum of invites/sec/host. When the invites max out, add some sleep to slow down the response to the requested host. This will probably slow down the bot, especially if the bot is trying to hit a lot of FS servers out there.
----- FreeSWITCH hosted on a Seagate DockStar with OpenWRT. -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/INVITE-DoS-Prevention-tp604761... Sent from the freeswitch-users mailing list archive at Nabble.com.
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org