You can use xml_cdr to log all calls going through your box. Xml_cdr tends to capture almost everything including where the UDP packet came from IP header wise.

You can also try Brain West’s blacklist here:

That black list blocks IPs that are known to be attacking boxes and so far, it’s pretty freaking effective against them ;)

From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Jessica Wang
Sent: Sunday, August 11, 2013 2:03 AM
To: FreeSWITCH Users Help
Subject: [Freeswitch-users] How to check who is attacking my fs server?

Dear all,

My FS server got attacked by someone. Unknown external user 107 is frequently calling strange number on my FS server. From the log, I can not find the real IP of this external user, the IP logged is my server's IP!

How can check who is doing this and block any similar action?

Part of the log is as below.

Thanks.

2013-08-11 09:48:12.401286 [NOTICE] switch_channel.c:951 New Channel sofia/external/107@(my fs server ip addr) [c1499822-0262-11e3-af23-2d4b950c464a]

2013-08-11 09:48:12.421101 [INFO] mod_dialplan_xml.c:485 Processing 107 <107>->+970598610587 in context public