Thanks to all. Effectively, in this case I had not detected it since the previous scans were much clearer and more abusive. I already had fail2ban in mind for that purpose. I also use a database for the users so I do not rule out applying any specific functionality like Don's. Thanks again. José David Jurado Alonso El mié., 22 ago. 2018 a las 21:57, Don Hawkins (<hawkins@hawkinsegroup.com>) escribió:
Yea, just to backup Michael and provide a little more detail - this is totally normal. We've been dealing with SIP scanners since day one and 1001 is for sure their favorite username.
fail2ban has it's benefits in this area but at least in my case tends to ban valid ip's/sip endpoints that register too often regardless of what settings/rules we provide.
Since your using a database for SIP users I'd recommend creating a custom solution as we've been forced to do. Basically authentication attempts using unrecognized usernanes have their IP blocked after 10 or so attempts. Also any registration attempted via IP and not a authorized domain (1001@myip vs 1001@thesipdomain) is automatically blocked using iptables.
Hope this helps!
Sent from my NationPCS Galaxy Note 5
On Tue, Aug 21, 2018, 5:51 PM Jose David Jurado Alonso < josedavid@zennio.com> wrote:
Hi,
I'm just observing in the log that user 1001 (and other random users like '55340115419480247') is continuously creating and closing channels.
That users doesn't exist (I delete the folder "directory" since I use database with different user names, no numbers).
I've done a search some reference to user 1001 in all the configuration and haven't found anything (using "grep -r '1001' /etc/freeswitch/*")
Any idea why this happens? A bot or spider maybe?
Log trace example:
2018-08-21 09:34:50.448541 [WARNING] switch_core_state_machine.c:687 1f89de01-b82f-44fa-9b91-9d111c44e220 sofia/internal/1001@192.168.1.120 Abandoned 2018-08-21 09:34:50.448541 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/1001@192.168.1.120 [CS_NEW] [WRONG_CALL_STATE] 2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1731 Session 291 (sofia/internal/1001@192.168.1.120) Ended 2018-08-21 09:34:50.448541 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/1001@192.168.1.120 [CS_DESTROY] 2018-08-21 09:34:51.288542 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/1001@192.168.1.120 [f8be20e3-1244-48bb-a89b-7b49382726af] 2018-08-21 09:34:52.568543 [WARNING] switch_core_state_machine.c:687 bae7044c-4915-4a9a-9265-6e48e969ffec sofia/internal/ 55340115419480247@192.168.1.120 Abandoned 2018-08-21 09:34:52.568543 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/55340115419480247@192.168.1.120 [CS_NEW] [WRONG_CALL_STATE] 2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1731 Session 292 (sofia/internal/55340115419480247@192.168.1.120) Ended 2018-08-21 09:34:52.568543 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/55340115419480247@192.168.1.120 [CS_DESTROY] 2018-08-21 09:34:52.848563 [WARNING] switch_core_state_machine.c:687 a0a39ab8-f109-468b-8136-3ebf044c2ffd sofia/internal/1001@192.168.1.120 Abandoned 2018-08-21 09:34:52.848563 [NOTICE] switch_core_state_machine.c:690 Hangup sofia/internal/1001@192.168.1.120 [CS_NEW] [WRONG_CALL_STATE] 2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1731 Session 293 (sofia/internal/1001@192.168.1.120) Ended 2018-08-21 09:34:52.848563 [NOTICE] switch_core_session.c:1735 Close Channel sofia/internal/1001@192.168.1.120 [CS_DESTROY] 2018-08-21 09:34:54.248541 [NOTICE] switch_channel.c:1104 New Channel sofia/internal/1001@192.168.1.120 [ef2d84f4-89e5-453d-89df-8280b129b42b] 2018-08-21 09:34:55.148543 [WARNING] switch_core_state_machine.c:687 9f1804f2-80d0-4fad-8e43-40f0cf2777e9 sofia/internal/1001@192.168.1.120 Abandoned
José D. Jurado Alonso _________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com
_________________________________________________________________________ Professional FreeSWITCH Services sales@freeswitch.com https://freeswitch.com
Official FreeSWITCH Sites https://freeswitch.com/oss https://freeswitch.org/confluence https://cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users https://freeswitch.com