In answer to a query on silently expiring fS from Eric Ni ... On 26 Jun 2015, at 19:56, Oz Mortimer <omortimer@gmail.com> wrote:
If it is a dos attack then as many have said, fail2ban is the way to go - though you should have that installed anyway. The simplest way to check if you are under attack is to install wireshark and issue: tethereal port 5060.
Most of the attacks I see seem to do DNS queries rather than blindly pinging 5060 => assume that the irritating bots know what port you're publishing in DNS as in use by SIP. And, of course, tethereal/tcpdump/... port <the port on which your server listens> all the best, Lawrence My permanent ipfw block list is now about 200-ish IP address ranges, all gleaned from fail2ban (don't leave home without it!)