I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this? "1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729" Thanks, Bala
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered. They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue. -Steve On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Thanks for your help. Do I still need to do any precautionary change? Thanks, Bala On Mon, May 13, 2013 at 1:19 PM, Steven Ayre <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
If you're concerned someone's trying to break in eg by guessing passwords you could look at http://wiki.freeswitch.org/wiki/Mod_fail2ban. A number of failed login attempts will block them from connecting again. Also check over your configuration to check what they would be able to do from the public context, and verify you're not using any of the default passwords. -Steve On 13 May 2013 09:02, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
Thanks for your help. Do I still need to do any precautionary change?
Thanks, Bala
On Mon, May 13, 2013 at 1:19 PM, Steven Ayre <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yes, I already have this. Looks everything is okay. Thanks for your help!! Thanks, Bala On Mon, May 13, 2013 at 4:37 PM, Steven Ayre <steveayre@gmail.com> wrote:
If you're concerned someone's trying to break in eg by guessing passwords you could look at http://wiki.freeswitch.org/wiki/Mod_fail2ban. A number of failed login attempts will block them from connecting again.
Also check over your configuration to check what they would be able to do from the public context, and verify you're not using any of the default passwords.
-Steve
On 13 May 2013 09:02, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
Thanks for your help. Do I still need to do any precautionary change?
Thanks, Bala
On Mon, May 13, 2013 at 1:19 PM, Steven Ayre <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that¹s the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past) To protect yourself, only allow calls to local extentsions from the public context... On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","" ,"","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","" ,"","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
You can install a log watching program that looks out for specific log entries and can take action. Eg; writing a firewall rule to ban the ip address of the system trying to make unauthorised calls. 'swatch' is a good tool for this in linux systems. http://sourceforge.net/projects/swatch/ John On 14/05/13 12:35 AM, Ken Rice wrote:
Re: [Freeswitch-users] Strange CDR entry Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that's the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken _http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org _irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
This is the purpose of the fail2ban system that was already mentioned. -Steve On 13 May 2013 15:52, Telecube - John <john@telecube.com.au> wrote:
You can install a log watching program that looks out for specific log entries and can take action. Eg; writing a firewall rule to ban the ip address of the system trying to make unauthorised calls.
'swatch' is a good tool for this in linux systems.
http://sourceforge.net/projects/swatch/
John
On 14/05/13 12:35 AM, Ken Rice wrote:
Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that’s the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com
Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Yep, fail2ban is another option.. it's nice to have options.. ;-) -John On 14/05/13 2:28 AM, Steven Ayre wrote:
This is the purpose of the fail2ban system that was already mentioned.
-Steve
On 13 May 2013 15:52, Telecube - John <john@telecube.com.au <mailto:john@telecube.com.au>> wrote:
You can install a log watching program that looks out for specific log entries and can take action. Eg; writing a firewall rule to ban the ip address of the system trying to make unauthorised calls.
'swatch' is a good tool for this in linux systems.
http://sourceforge.net/projects/swatch/
John
On 14/05/13 12:35 AM, Ken Rice wrote:
Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that's the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com <http://steveayre@gmail.com>> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com <http://b2m@a-cti.com>> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken _http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org _irc.freenode.net <http://irc.freenode.net> #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
+1. This is what i meant by checking the public context. :) On 13 May 2013 15:35, Ken Rice <krice@freeswitch.org> wrote:
Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that’s the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
I bet that DID is hosted by Jawal. Jawal is a Palestinian telco, but I think that 0598 is specifically cellular, so it's not limited to Gaza. I've seen these hitting other servers on the Interwebs as well... -Yossi On 05/13/2013 09:35 AM, Ken Rice wrote:
Re: [Freeswitch-users] Strange CDR entry Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that's the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken _http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org _irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
We saw that hitting our servers too quite often. Looks like some kind of automated program. The script tries to call these numbers. It never got successful though. Thanks, -- Muhammad Naseer Bhatti I put the Who? in Mishehu wrote:
I bet that DID is hosted by Jawal. Jawal is a Palestinian telco, but I think that 0598 is specifically cellular, so it's not limited to Gaza. I've seen these hitting other servers on the Interwebs as well...
-Yossi
On 05/13/2013 09:35 AM, Ken Rice wrote:
Ok look at the 3rd column... This is someone trying to figure out how to get calls thru your public context with various prefix codexs... Notices how all the calls end with 972598371070 <-- that’s the intl destination umber probably a phone in gaza (definitely in Isreali controlled areas, but I think I looked up this number or similar number in the past)
To protect yourself, only allow calls to local extentsions from the public context...
On 5/13/13 2:49 AM, "Steven Ayre" <steveayre@gmail.com> wrote:
The call duration is 0 seconds so no they didn't get in. Any accepted call attempt will generate a CDR even if it was not answered.
They're coming in on the 'public' context which'll mean an unauthenticated call on the external profile. That would be the context allowing you to receive calls from strangers. Providing that context doesn't allow them to dial out via providers that charge you this isn't an issue.
-Steve
On 13 May 2013 07:17, Bala Murugan Mahendran <b2m@a-cti.com> wrote:
I have lot of entries like 1000,1001,1002 and so on, Is someone trying to get inside? I believe they didn't in yet but how come we have cdr log like this?
"1004","1004","012972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729" "1004","1004","013972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729" "1004","1004","014972598371070","public","2013-05-12 07:30:07","","2013-05-12 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729" "1004","1004","010972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729" "1004","1004","0061972598371070","public","2013-05-12 07:30:08","","2013-05-12 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729" "1004","1004","0041972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729" "1004","1004","000972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729" "1004","1004","006972598371070","public","2013-05-12 07:30:09","","2013-05-12 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729" "1004","1004","002972598371070","public","2013-05-12 07:30:10","","2013-05-12 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729" "1004","1004","810972598371070","public","2013-05-12 07:29:49","","2013-05-12 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
Thanks, Bala
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
------------------------------------------------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken _http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org _irc.freenode.net #freeswitch
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (6)
-
Bala Murugan Mahendran
-
I put the Who? in Mishehu
-
Ken Rice
-
Muhammad Naseer Bhatti
-
Steven Ayre
-
Telecube - John