CDRs say: network_addr 85.195.107.50 For calls to 107. I guess I'm getting the same attack. -Avi On Sun, Aug 11, 2013 at 12:03 PM, Jessica Wang <xyangni@gmail.com> wrote:

Dear all,

My FS server got attacked by someone. Unknown external user 107 is frequently calling strange number on my FS server. From the log, I can not find the real IP of this external user, the IP logged is my server's IP! How can check who is doing this and block any similar action? Part of the log is as below.

Thanks.

2013-08-11 09:48:12.401286 [NOTICE] switch_channel.c:951 New Channel sofia/external/107@(my fs server ip addr) [c1499822-0262-11e3-af23-2d4b950c464a] 2013-08-11 09:48:12.421101 [INFO] mod_dialplan_xml.c:485 Processing 107 <107>->+970598610587 in context public

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

You can use xml_cdr to log all calls going through your box. Xml_cdr tends to capture almost everything including where the UDP packet came from IP header wise. You can also try Brain West's blacklist here: http://daffy.bkw.org/blacklist.txt That black list blocks IPs that are known to be attacking boxes and so far, it's pretty freaking effective against them ;) From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Jessica Wang Sent: Sunday, August 11, 2013 2:03 AM To: FreeSWITCH Users Help Subject: [Freeswitch-users] How to check who is attacking my fs server? Dear all, My FS server got attacked by someone. Unknown external user 107 is frequently calling strange number on my FS server. From the log, I can not find the real IP of this external user, the IP logged is my server's IP! How can check who is doing this and block any similar action? Part of the log is as below. Thanks. 2013-08-11 09:48:12.401286 [NOTICE] switch_channel.c:951 New Channel sofia/external/107@(my fs server ip addr) [c1499822-0262-11e3-af23-2d4b950c464a] 2013-08-11 09:48:12.421101 [INFO] mod_dialplan_xml.c:485 Processing 107 <107>->+970598610587 in context public