Fail2ban protects against this. Somebody mentioned it here on the mailing list a few days ago and it's also on the wiki. On Fri, Oct 22, 2010 at 6:26 AM, Jonas Gauffin <jonas.gauffin@gmail.com> wrote:
Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically
Den 2010 10 5 20:53 skrev "Anthony Minessale" <anthony.minessale@gmail.com>:
Are you perhaps getting ddos'd by some sip scanner?
On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State
================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED
================================================================================================= 2 profiles 2 aliases
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org