Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically
Den 2010 10 5 20:53 skrev "Anthony Minessale" <anthony.minessale@gmail.com>: > Are you perhaps getting ddos'd by some sip scanner?
> > > On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote: >> Starting last night at 2am (it had been up for 10 hours) FS issued:
>> 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. >> Now, when I start FS I get the message right away and heavy disk >> thrashing. For the last couple of weeks while working on FS this
>> messages never came up (that I noticed). The machine goes to 100 percent >> processor and the disk thrashes. I removed all external SIP accounts and >> the ip-v6 profile to test and it still happens. This came out of the
>> blue and stopped everything I was working on. Looking into this all I >> could find was it may be related to UPnP which the router has. Had been >> working fine until now. Any help greatly appreciated. Mario
>> >> When I issue the shutdown command FS end with an error: >> >> 2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 >> mod_siren has no shutdown routine >> 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518
>> Deleting Codec SPEEX 99 Speex 32000hz 20ms >> 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 >> Deleting Codec SPEEX 99 Speex 16000hz 20ms >> 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518
>> Deleting Codec SPEEX 99 Speex 8000hz 20ms >> 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 >> mod_speex has no shutdown routine >> Segmentation fault (core dumped)
>> >> Name Type >> Data State >> ================================================================================================= >> 210.17.234.127 alias
>> internal ALIASED >> internal profile >> sip:mod_sofia@100.24.1.37:5060 RUNNING (0) >> external profile
>> sip:mod_sofia@100.24.1.37:5080 RUNNING (0) >> 100.24.1.37 alias >> internal ALIASED >> =================================================================================================
>> 2 profiles 2 aliases >> >> _______________________________________________ >> FreeSWITCH-users mailing list >> FreeSWITCH-users@lists.freeswitch.org
>> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users >> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>> http://www.freeswitch.org >> > > > > -- > Anthony Minessale II > > FreeSWITCH http://www.freeswitch.org/
> ClueCon http://www.cluecon.com/ > Twitter: http://twitter.com/FreeSWITCH_wire > > AIM: anthm > MSN:anthony_minessale@hotmail.com
> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com > IRC: irc.freenode.net #freeswitch > > FreeSWITCH Developer Conference
> sip:888@conference.freeswitch.org > googletalk:conf+888@conference.freeswitch.org
> pstn:+19193869900 > > _______________________________________________ > FreeSWITCH-users mailing list > FreeSWITCH-users@lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users > UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org