Depends on your config. If the attack is vicious enough, the best defense it to block it upstream, if possible. I always put my servers behind firewalls, but that's me. My firewall is helpful in that is limits the connections per second from any ip address. This is not something that can be helpful if the attack is distributed though. There are some good scripts out there to help identify a potential attack and help alert your firewall, etc. On Tue, Oct 5, 2010 at 2:55 PM, Mario <mario_fs@mgtech.com> wrote:
After working 4 hours I found that FS was hosed due to someone from 208.109.87.234 sending tons of traffic to FS. I blocked the IP address. Not only did it overload the connection but stopped FS from working, meaning no phones. This had not happened with the SPA9000. I listed on on a FS conference call discussing this issue. Is there someplace that has a list of things to do to prevent/reduce this? I did have ports, etc. blocked in the firewall. Thanks. Mario
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- ====================== Tony Graziano, Manager Telephone: 434.984.8430 sip: tgraziano@voice.myitdepartment.net Fax: 434.984.8431 Email: tgraziano@myitdepartment.net LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 sip: helpdesk@voice.myitdepartment.net Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ Why do mathematicians always confuse Halloween and Christmas? Because 31 Oct = 25 Dec.