FS disk thrashing after 1440 Auto-Adding Alias + segmentation fault
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario When I issue the shutdown command FS end with an error: 2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped) Name Type Data State ================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED ================================================================================================= 2 profiles 2 aliases
Are you perhaps getting ddos'd by some sip scanner? On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State ================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED ================================================================================================= 2 profiles 2 aliases
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically Den 2010 10 5 20:53 skrev "Anthony Minessale" <anthony.minessale@gmail.com>:
Are you perhaps getting ddos'd by some sip scanner?
On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State
=================================================================================================
210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED
=================================================================================================
2 profiles 2 aliases
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com <MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com<PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <sip%3A888@conference.freeswitch.org> googletalk:conf+888@conference.freeswitch.org<googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
perhaps u need to read this http://www.fail2ban.org/wiki/index.php/Main_Page On Fri, Oct 22, 2010 at 6:26 PM, Jonas Gauffin <jonas.gauffin@gmail.com> wrote:
Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically
Den 2010 10 5 20:53 skrev "Anthony Minessale" <anthony.minessale@gmail.com>:
Are you perhaps getting ddos'd by some sip scanner?
On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State
================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED
================================================================================================= 2 profiles 2 aliases
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ghulam Mustafa cell: +92 333.611.7681 sip: cyrenity@ekiga.net mail: mustafa.pk@gmail.com web: cyrenity.wordpress.com
Fail2ban protects against this. Somebody mentioned it here on the mailing list a few days ago and it's also on the wiki. On Fri, Oct 22, 2010 at 6:26 AM, Jonas Gauffin <jonas.gauffin@gmail.com> wrote:
Can fs detect register or invite ddos and generate an event with the offending ip? Could be used through the event socket to add fw rules automatically
Den 2010 10 5 20:53 skrev "Anthony Minessale" <anthony.minessale@gmail.com>:
Are you perhaps getting ddos'd by some sip scanner?
On Tue, Oct 5, 2010 at 12:55 PM, Mario <mario_fs@mgtech.com> wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State
================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED
================================================================================================= 2 profiles 2 aliases
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Anthony Minessale II
FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire
AIM: anthm MSN:anthony_minessale@hotmail.com GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com IRC: irc.freenode.net #freeswitch
FreeSWITCH Developer Conference sip:888@conference.freeswitch.org googletalk:conf+888@conference.freeswitch.org pstn:+19193869900
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_______________________________________________ FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
This turned out to be a hack attempt from outside! Once I blocked the offending address things started working. FYI the hacker is 208.109.87.234. On 10/05/10 10:55, Mario wrote:
Starting last night at 2am (it had been up for 10 hours) FS issued: 1440 Auto-Adding Alias [208.2.3.4] for profile [internal]. Now, when I start FS I get the message right away and heavy disk thrashing. For the last couple of weeks while working on FS this messages never came up (that I noticed). The machine goes to 100 percent processor and the disk thrashes. I removed all external SIP accounts and the ip-v6 profile to test and it still happens. This came out of the blue and stopped everything I was working on. Looking into this all I could find was it may be related to UPnP which the router has. Had been working fine until now. Any help greatly appreciated. Mario
When I issue the shutdown command FS end with an error:
2010-10-05 10:22:44.889143 [CONSOLE] switch_loadable_module.c:1401 mod_siren has no shutdown routine 2010-10-05 10:22:44.889167 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 32000hz 20ms 2010-10-05 10:22:44.889213 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 16000hz 20ms 2010-10-05 10:22:44.889257 [NOTICE] switch_loadable_module.c:518 Deleting Codec SPEEX 99 Speex 8000hz 20ms 2010-10-05 10:22:44.889330 [CONSOLE] switch_loadable_module.c:1401 mod_speex has no shutdown routine Segmentation fault (core dumped)
Name Type Data State ================================================================================================= 210.17.234.127 alias internal ALIASED internal profile sip:mod_sofia@100.24.1.37:5060 RUNNING (0) external profile sip:mod_sofia@100.24.1.37:5080 RUNNING (0) 100.24.1.37 alias internal ALIASED ================================================================================================= 2 profiles 2 aliases
participants (5)
-
Anthony Minessale
-
Ghulam Mustafa
-
Jeffrey Leung
-
Jonas Gauffin
-
Mario