We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn't catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml and reloaded but there was no change in behavior: <param name="log-auth-failures" value="true"/> Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged. I'm not sure why this attack doesn't generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time. Of course I'd prefer to ban only on failures. The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash. Here is an excerpt of the traffic: 2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 freeswitch@internal> sofia profile internal siptrace on Enabled sip debugging on internal 2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941: ------------------------------------------------------------------------ REGISTER sip:xx.xx.xx.xx SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport Content-Length: 0 From: "4623" <sip:4623@xx.xx.xx.xx> Accept: application/sdp User-Agent: friendly-scanner To: "4623" <sip:4623@xx.xx.xx.xx> Contact: sip:123@1.1.1.1 CSeq: 1 REGISTER Call-ID: 1757394 Max-Forwards: 70 ------------------------------------------------------------------------ 2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75 From: "4623" <sip:4623@xx.xx.xx.xx> To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F Call-ID: 1757394 CSeq: 1 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth" Content-Length: 0 ------------------------------------------------------------------------ recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418: ------------------------------------------------------------------------ REGISTER sip:xx.xx.xx.xx SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport Content-Length: 0 From: "4623" <sip:4623@xx.xx.xx.xx> Accept: application/sdp User-Agent: friendly-scanner To: "4623" <sip:4623@xx.xx.xx.xx> Contact: sip:123@1.1.1.1 CSeq: 1 REGISTER Call-ID: 2727970266 Max-Forwards: 70 ------------------------------------------------------------------------ 2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75 send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851: ------------------------------------------------------------------------ SIP/2.0 401 Unauthorized Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75 From: "4623" <sip:4623@xx.xx.xx.xx> To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB Call-ID: 2727970266 CSeq: 1 REGISTER User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE Supported: timer, precondition, path, replaces WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth" Content-Length: 0 Phil Quesinberry Q Systems Engineering, Inc. Electronic Controls and Embedded Systems Development (410) 969-8002 http://www.qsystemsengineering.com
Thanks Ken. I'm aware of the iptables fix and should probably go ahead and put that in, although the newer versions of SIPVicious do not give themselves away so easily. What is so special about the attack that keeps FS from generating a failure message? -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... Sent from the freeswitch-users mailing list archive at Nabble.com.
See http://jira.freeswitch.org/browse/FS-3094 specifically : http://jira.freeswitch.org/secure/attachment/16104/jira3094-20120315.diff if you have big enough kahoonies you can patch your install. I have just email'd Ken to discuss this jira and to try and get it in head. If your the helpful kind, you could take that patch I wrote and bring it up to current GIT head then put it back on that Jira. Jay On 20 March 2013 14:44, PhilQ <philq@qsystemsengineering.com> wrote:
Thanks Ken. I'm aware of the iptables fix and should probably go ahead and put that in, although the newer versions of SIPVicious do not give themselves away so easily.
What is so special about the attack that keeps FS from generating a failure message?
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Sincerely Jay
Theres rules on the wiki for iptables for banning friendly scanner completely On 3/19/13 10:21 PM, "Phil Quesinberry" <philq@qsystemsengineering.com> wrote:
We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn¹t catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml and reloaded but there was no change in behavior:
<param name="log-auth-failures" value="true"/>
Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged.
I¹m not sure why this attack doesn¹t generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time. Of course I¹d prefer to ban only on failures.
The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash.
Here is an excerpt of the traffic:
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
freeswitch@internal> sofia profile internal siptrace on
Enabled sip debugging on internal
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 1757394
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F
Call-ID: 1757394
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"
Content-Length: 0
------------------------------------------------------------------------
recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 2727970266
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB
Call-ID: 2727970266
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"
Content-Length: 0
Phil Quesinberry
Q Systems Engineering, Inc.
Electronic Controls and Embedded Systems Development
(410) 969-8002
http://www.qsystemsengineering.com <http://www.qsystemsengineering.com>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
log auth failures only logs when there's been an actual failure: reg -> 401 (send password again with md5 hashed password -> reg failure. It sounds like this attack was just "reg" so it didn't get triggered. That's why there's a separate fail2ban profile for floods -- http://wiki.freeswitch.org/wiki/Fail2ban#SIP_DOS_Attack There's another module that makes a dedicated log for fail2ban but I don't think it's been tested much: http://wiki.freeswitch.org/wiki/Mod_fail2ban -Avi Marcus BestFone On Wed, Mar 20, 2013 at 6:21 AM, Phil Quesinberry < philq@qsystemsengineering.com> wrote:
**
We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn’t catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml and reloaded but there was no change in behavior:
<param name="log-auth-failures" value="true"/>
Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged.
I’m not sure why this attack doesn’t generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time. Of course I’d prefer to ban only onfailures.
The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash.
Here is an excerpt of the traffic:
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
freeswitch@internal> sofia profile internal siptrace on
Enabled sip debugging on internal
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 1757394
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115 ;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F
Call-ID: 1757394
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"
Content-Length: 0
------------------------------------------------------------------------
recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 2727970266
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707 ;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB
Call-ID: 2727970266
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"
Content-Length: 0
*******Phil Quesinberry*
Q Systems Engineering, Inc.
Electronic Controls and Embedded Systems Development
(410) 969-8002
*****http://www.qsystemsengineering.com*<http://www.qsystemsengineering.com>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
Not only is there fail2ban rules, a colleague is having great success with snort for blocking sipvicious attacks. On 20 March 2013 08:24, Avi Marcus <avi@avimarcus.net> wrote:
log auth failures only logs when there's been an actual failure: reg -> 401 (send password again with md5 hashed password -> reg failure.
It sounds like this attack was just "reg" so it didn't get triggered.
That's why there's a separate fail2ban profile for floods -- http://wiki.freeswitch.org/wiki/Fail2ban#SIP_DOS_Attack
There's another module that makes a dedicated log for fail2ban but I don't think it's been tested much: http://wiki.freeswitch.org/wiki/Mod_fail2ban
-Avi Marcus BestFone
On Wed, Mar 20, 2013 at 6:21 AM, Phil Quesinberry < philq@qsystemsengineering.com> wrote:
**
We were the recipients of another script-kiddie SIPVicious attack this evening, but Fail2ban didn’t catch it because there was no failure message in the log, just repeated registration messages. I added the following to sofia.conf.xml and reloaded but there was no change in behavior:
<param name="log-auth-failures" value="true"/>
Interestingly, if I tell the Aastra on my desk to register with the wrong password, there is a failure message logged.
I’m not sure why this attack doesn’t generate a failure message but I added a rule under filter.d to ban IPs with too many registration attempts in a certain period of time. Of course I’d prefer to ban only on failures.
The user agent string would seem to indicate that this is an older version of SIPVicious but I was unable to crash it with svcrash.
Here is an excerpt of the traffic:
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.160919 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.181262 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
freeswitch@internal> sofia profile internal siptrace on
Enabled sip debugging on internal
2013-03-19 21:48:24.201143 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
recv 333 bytes from udp/[70.38.71.75]:5115 at 01:48:24.223941:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-1676888071;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 1757394
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 621 bytes to udp/[70.38.71.75]:5115 at 01:48:24.225084:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115 ;branch=z9hG4bK-1676888071;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=tNtgHUjZSej3F
Call-ID: 1757394
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="c34ebd55-e53c-4590-b7e8-423e21fc26b9", algorithm=MD5, qop="auth"
Content-Length: 0
------------------------------------------------------------------------
recv 336 bytes from udp/[70.38.71.75]:5115 at 01:48:24.234418:
------------------------------------------------------------------------
REGISTER sip:xx.xx.xx.xx SIP/2.0
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707;rport
Content-Length: 0
From: "4623" <sip:4623@xx.xx.xx.xx>
Accept: application/sdp
User-Agent: friendly-scanner
To: "4623" <sip:4623@xx.xx.xx.xx>
Contact: sip:123@1.1.1.1
CSeq: 1 REGISTER
Call-ID: 2727970266
Max-Forwards: 70
------------------------------------------------------------------------
2013-03-19 21:48:24.220953 [WARNING] sofia_reg.c:1520 SIP auth challenge (REGISTER) on sofia profile 'internal' for [4623@xx.xx.xx.xx] from ip 70.38.71.75
send 624 bytes to udp/[70.38.71.75]:5115 at 01:48:24.235851:
------------------------------------------------------------------------
SIP/2.0 401 Unauthorized
Via: SIP/2.0/UDP 127.0.0.1:5115;branch=z9hG4bK-2042428707 ;rport=5115;received=70.38.71.75
From: "4623" <sip:4623@xx.xx.xx.xx>
To: "4623" <sip:4623@xx.xx.xx.xx>;tag=UyK9jp32pQ8NB
Call-ID: 2727970266
CSeq: 1 REGISTER
User-Agent: FreeSWITCH-mod_sofia/1.3.14b+git~20130301T214848Z~c35a41e4ca
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, precondition, path, replaces
WWW-Authenticate: Digest realm="xx.xx.xx.xx", nonce="6343aee4-d0a4-4357-b34d-11a4658b954c", algorithm=MD5, qop="auth"
Content-Length: 0
*******Phil Quesinberry*
Q Systems Engineering, Inc.
Electronic Controls and Embedded Systems Development
(410) 969-8002
*****http://www.qsystemsengineering.com*<http://www.qsystemsengineering.com>
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- *Andrew Cassidy BSc (Hons) MBCS SSCA* Managing Director *T <info@cassidywebservices.co.uk> *03300 100 960 *F<info@cassidywebservices.co.uk> *03300 100 961 *E <info@cassidywebservices.co.uk> *andrew@cassidywebservices.co.uk *W <info@cassidywebservices.co.uk> *www.cassidywebservices.co.uk
What I did was very similar to the separate flood rule, I just grouped the regex in with the auth failure rule. FYI - the attack is still ongoing this morning. I have fail2ban set to ban IPs for 10 hours at a time and noticed in the log that the offending IP was re-banned after 2 seconds, (maxretry is set to a somewhat liberal 150 attempts). For what it's worth, the attack is coming from 70.38.71.75, which is within an IP block owned by iWeb Technologies. I personally called and spoke with one of their support staff yesterday morning after having sent a message detailing the issue to their abuse contact email address the night before, since I thought they would be very interested in stopping someone from using their service to launch an attack. I was mistaken. The support guy on the phone was passing it along to his team who would "get right on it". Based on their apparent lack of ability to solve this problem after a day and a half, I'd give them a pass unless you're a script-kiddie looking to leverage a provider who's not minding the store to launch attacks against other computing resources. If that's the case, then that's the place. Adding their IP netblock to your firewall's blacklist might be a good idea. iWeb Technologies Inc. IWEB-BLK-05 (NET-70-38-0-0-1) 70.38.0.0 - 70.38.127.255 iWeb Dedicated CL2 IWEB-CL-T160-01SH (NET-70-38-71-64-1) 70.38.71.64 - 70.38.71.95 - Phil -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... Sent from the freeswitch-users mailing list archive at Nabble.com.
On linux, the following is quite effective at mitigating most SIPVicious activity iptables -I INPUT -j DROP -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm On 3/21/13 9:09 AM, "PhilQ" <philq@qsystemsengineering.com> wrote:
What I did was very similar to the separate flood rule, I just grouped the regex in with the auth failure rule.
FYI - the attack is still ongoing this morning. I have fail2ban set to ban IPs for 10 hours at a time and noticed in the log that the offending IP was re-banned after 2 seconds, (maxretry is set to a somewhat liberal 150 attempts).
For what it's worth, the attack is coming from 70.38.71.75, which is within an IP block owned by iWeb Technologies. I personally called and spoke with one of their support staff yesterday morning after having sent a message detailing the issue to their abuse contact email address the night before, since I thought they would be very interested in stopping someone from using their service to launch an attack. I was mistaken. The support guy on the phone was passing it along to his team who would "get right on it".
Based on their apparent lack of ability to solve this problem after a day and a half, I'd give them a pass unless you're a script-kiddie looking to leverage a provider who's not minding the store to launch attacks against other computing resources. If that's the case, then that's the place. Adding their IP netblock to your firewall's blacklist might be a good idea.
iWeb Technologies Inc. IWEB-BLK-05 (NET-70-38-0-0-1) 70.38.0.0 - 70.38.127.255 iWeb Dedicated CL2 IWEB-CL-T160-01SH (NET-70-38-71-64-1) 70.38.71.64 - 70.38.71.95
- Phil
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... g-SIPVicious-attack-tp7588841p7588912.html Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch
Apparently the attacker finally decided that 150 tries every 10 hours would take too long and gave up, or iWeb finally took care of business. Here’s another interesting one though… every 9 minutes and 15 seconds on the dot, there’s an invite from an IP in Russia that’s attempting to call the US toll free number for Microsoft PC Safety. Weird. The user agent string identifies it as Asterisk 1.6.2. Perhaps we should redirect them to a recording which tells them how to use TollFreeGateway to complete the call. :) FS console: 2013-03-22 00:15:18.178177 [NOTICE] switch_channel.c:976 New Channel sofia/internal/10186672723381@0.0.0.0:5060 [059bb40d-33b4-4086-b456-6663f3ad2d6a] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_state_machine.c:415 (sofia/internal/10186672723381@0.0.0.0:5060) Running State Change CS_NEW 2013-03-22 00:15:18.178177 [DEBUG] switch_core_state_machine.c:433 (sofia/internal/10186672723381@0.0.0.0:5060) State NEW 2013-03-22 00:15:18.210157 [DEBUG] sofia.c:7752 IP 93.170.130.201 Rejected by acl "domains". Falling back to Digest auth. 2013-03-22 00:15:18.210157 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.210157 [DEBUG] sofia.c:1730 detaching session 059bb40d-33b4-4086-b456-6663f3ad2d6a 2013-03-22 00:15:18.210157 [WARNING] sofia_reg.c:1520 SIP auth challenge (INVITE) on sofia profile 'internal' for [018667272338@xx.xx.xx.xx] from ip 93.170.130.201 2013-03-22 00:15:30.177999 [WARNING] switch_core_state_machine.c:514 059bb40d-33b4-4086-b456-6663f3ad2d6a sofia/internal/10186672723381@0.0.0.0:5060 Abandoned 2013-03-22 00:15:30.177999 [DEBUG] switch_channel.c:3011 (sofia/internal/10186672723381@0.0.0.0:5060) Callstate Change DOWN -> HANGUP 2013-03-22 00:15:30.177999 [NOTICE] switch_core_state_machine.c:517 Hangup sofia/internal/10186672723381@0.0.0.0:5060 [CS_NEW] [WRONG_CALL_STATE] ... Tcpdump: [root@server log]# tcpdump -nnXSs 512 host 93.170.130.201 tcpdump: WARNING: peth0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on peth0, link-type EN10MB (Ethernet), capture size 512 bytes 00:15:18.185048 IP 93.170.130.201.5060 > 192.168.1.6.5060: SIP, length: 466 0x0000: 4500 01ee 0000 4000 fc11 dadc 5daa 82c9 E.....@.....]... 0x0010: c0a8 0106 13c4 13c4 01da 1ca1 494e 5649 ............INVI 0x0020: 5445 2073 6970 3a30 3138 3636 3732 3732 TE.sip:018667272 0x0030: 3333 3840 xxxx 2exx xxxx 2exx xx2e xxxx 338@xx.xx.xx.xx 0x0040: 363a 3530 3630 2053 4950 2f32 2e30 0d0a 6:5060.SIP/2.0.. 0x0050: 4361 6c6c 2d49 443a 2039 3831 3961 3362 Call-ID:.9819a3b 0x0060: 372d 3839 6535 2d34 6534 382d 3862 6630 7-89e5-4e48-8bf0 0x0070: 2d37 6139 3532 3266 6133 3362 300d 0a43 -7a9522fa33b0..C 0x0080: 5365 713a 2031 2049 4e56 4954 450d 0a56 Seq:.1.INVITE..V 0x0090: 6961 3a20 5349 502f 322e 302f 5544 5020 ia:.SIP/2.0/UDP. 0x00a0: 302e 302e 302e 303a 3530 3630 3b62 7261 0.0.0.0:5060;bra 0x00b0: 6e63 683d 7a39 6847 3462 4b2d 3831 3564 nch=z9hG4bK-815d 0x00c0: 3130 3633 6134 6631 3b72 706f 7274 0d0a 1063a4f1;rport.. 0x00d0: 4672 6f6d 3a20 3c73 6970 3a31 3031 3836 From:.<sip:10186 0x00e0: 3637 3237 3233 3338 3140 302e 302e 302e 672723381@0.0.0. 0x00f0: 303a 3530 3630 3e3b 7461 673d 4e44 6469 0:5060>;tag=NDdi 0x0100: 4d7a 4531 4e7a 5178 4d32 4d30 4d44 4177 MzE1NzQxM2M0MDAw 0x0110: 4d44 5533 4154 4530 4f44 4d31 4e54 5934 MDU3ATE0ODM1NTY4 0x0120: 0d0a 546f 3a20 3c73 6970 3a30 3138 3636 ..To:.<sip:01866 0x0130: 3732 3732 3333 3840 xxxx 2exx xxxx 2exx 7272338@xx.xx.x 0x0140: xx2e xxxx xx3e 0d0a 436f 6e74 6163 743a x.xx>..Contact: 0x0150: 2022 3130 3138 3636 3732 3732 3333 3831 ."10186672723381 0x0160: 2220 3c73 6970 3a31 3031 3836 3637 3237 ".<sip:101866727 0x0170: 3233 3338 3130 2e30 2e30 2e30 3a35 3036 233810.0.0.0:506 0x0180: 303b 7472 616e 7370 6f72 743d 7564 703e 0;transport=udp> 0x0190: 0d0a 4d61 782d 466f 7277 6172 6473 3a20 ..Max-Forwards:. 0x01a0: 3730 0d0a 5573 6572 2d41 6765 6e74 3a20 70..User-Agent:. 0x01b0: 4173 7465 7269 736b 2031 2e36 2e32 0d0a Asterisk.1.6.2.. 0x01c0: 4163 6365 7074 3a20 6170 706c 6963 6174 Accept:.applicat 0x01d0: 696f 6e2f 7364 700d 0a43 6f6e 7465 6e74 ion/sdp..Content 0x01e0: 2d4c 656e 6768 743a 2030 0d0a 0d0a -Lenght:.0.... -- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... Sent from the freeswitch-users mailing list archive at Nabble.com.
Not that weird at all... this was probably not a targeted attack. There are botnets that do nothing other than crawling through all possible IP addresses looking for SIP servers and when they find one making various dial attempts to see if it's insecure. Answering the call will probably do nothing other than appear that the call 'worked' (they'll not be at MS or listening to media so will only know it rang / was answered), putting you on a list and having them come back later to try to make other calls. -Steve On 22 March 2013 05:00, PhilQ <philq@qsystemsengineering.com> wrote:
Apparently the attacker finally decided that 150 tries every 10 hours would take too long and gave up, or iWeb finally took care of business.
Here’s another interesting one though… every 9 minutes and 15 seconds on the dot, there’s an invite from an IP in Russia that’s attempting to call the US toll free number for Microsoft PC Safety. Weird. The user agent string identifies it as Asterisk 1.6.2. Perhaps we should redirect them to a recording which tells them how to use TollFreeGateway to complete the call. :)
FS console: 2013-03-22 00:15:18.178177 [NOTICE] switch_channel.c:976 New Channel sofia/internal/10186672723381@0.0.0.0:5060 [059bb40d-33b4-4086-b456-6663f3ad2d6a] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.178177 [DEBUG] switch_core_state_machine.c:415 (sofia/internal/10186672723381@0.0.0.0:5060) Running State Change CS_NEW 2013-03-22 00:15:18.178177 [DEBUG] switch_core_state_machine.c:433 (sofia/internal/10186672723381@0.0.0.0:5060) State NEW 2013-03-22 00:15:18.210157 [DEBUG] sofia.c:7752 IP 93.170.130.201 Rejected by acl "domains". Falling back to Digest auth. 2013-03-22 00:15:18.210157 [DEBUG] switch_core_session.c:975 Send signal sofia/internal/10186672723381@0.0.0.0:5060 [BREAK] 2013-03-22 00:15:18.210157 [DEBUG] sofia.c:1730 detaching session 059bb40d-33b4-4086-b456-6663f3ad2d6a 2013-03-22 00:15:18.210157 [WARNING] sofia_reg.c:1520 SIP auth challenge (INVITE) on sofia profile 'internal' for [018667272338@xx.xx.xx.xx] from ip 93.170.130.201 2013-03-22 00:15:30.177999 [WARNING] switch_core_state_machine.c:514 059bb40d-33b4-4086-b456-6663f3ad2d6a sofia/internal/10186672723381@0.0.0.0:5060 Abandoned 2013-03-22 00:15:30.177999 [DEBUG] switch_channel.c:3011 (sofia/internal/10186672723381@0.0.0.0:5060) Callstate Change DOWN -> HANGUP 2013-03-22 00:15:30.177999 [NOTICE] switch_core_state_machine.c:517 Hangup sofia/internal/10186672723381@0.0.0.0:5060 [CS_NEW] [WRONG_CALL_STATE] ...
Tcpdump: [root@server log]# tcpdump -nnXSs 512 host 93.170.130.201 tcpdump: WARNING: peth0: no IPv4 address assigned tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on peth0, link-type EN10MB (Ethernet), capture size 512 bytes 00:15:18.185048 IP 93.170.130.201.5060 > 192.168.1.6.5060: SIP, length: 466 0x0000: 4500 01ee 0000 4000 fc11 dadc 5daa 82c9 E.....@.....]... 0x0010: c0a8 0106 13c4 13c4 01da 1ca1 494e 5649 ............INVI 0x0020: 5445 2073 6970 3a30 3138 3636 3732 3732 TE.sip:018667272 0x0030: 3333 3840 xxxx 2exx xxxx 2exx xx2e xxxx 338@xx.xx.xx.xx 0x0040: 363a 3530 3630 2053 4950 2f32 2e30 0d0a 6:5060.SIP/2.0.. 0x0050: 4361 6c6c 2d49 443a 2039 3831 3961 3362 Call-ID:.9819a3b 0x0060: 372d 3839 6535 2d34 6534 382d 3862 6630 7-89e5-4e48-8bf0 0x0070: 2d37 6139 3532 3266 6133 3362 300d 0a43 -7a9522fa33b0..C 0x0080: 5365 713a 2031 2049 4e56 4954 450d 0a56 Seq:.1.INVITE..V 0x0090: 6961 3a20 5349 502f 322e 302f 5544 5020 ia:.SIP/2.0/UDP. 0x00a0: 302e 302e 302e 303a 3530 3630 3b62 7261 0.0.0.0:5060;bra 0x00b0: 6e63 683d 7a39 6847 3462 4b2d 3831 3564 nch=z9hG4bK-815d 0x00c0: 3130 3633 6134 6631 3b72 706f 7274 0d0a 1063a4f1;rport.. 0x00d0: 4672 6f6d 3a20 3c73 6970 3a31 3031 3836 From:.<sip:10186 0x00e0: 3637 3237 3233 3338 3140 302e 302e 302e 672723381@0.0.0. 0x00f0: 303a 3530 3630 3e3b 7461 673d 4e44 6469 0:5060>;tag=NDdi 0x0100: 4d7a 4531 4e7a 5178 4d32 4d30 4d44 4177 MzE1NzQxM2M0MDAw 0x0110: 4d44 5533 4154 4530 4f44 4d31 4e54 5934 MDU3ATE0ODM1NTY4 0x0120: 0d0a 546f 3a20 3c73 6970 3a30 3138 3636 ..To:.<sip:01866 0x0130: 3732 3732 3333 3840 xxxx 2exx xxxx 2exx 7272338@xx.xx.x 0x0140: xx2e xxxx xx3e 0d0a 436f 6e74 6163 743a x.xx>..Contact: 0x0150: 2022 3130 3138 3636 3732 3732 3333 3831 ."10186672723381 0x0160: 2220 3c73 6970 3a31 3031 3836 3637 3237 ".<sip:101866727 0x0170: 3233 3338 3130 2e30 2e30 2e30 3a35 3036 233810.0.0.0:506 0x0180: 303b 7472 616e 7370 6f72 743d 7564 703e 0;transport=udp> 0x0190: 0d0a 4d61 782d 466f 7277 6172 6473 3a20 ..Max-Forwards:. 0x01a0: 3730 0d0a 5573 6572 2d41 6765 6e74 3a20 70..User-Agent:. 0x01b0: 4173 7465 7269 736b 2031 2e36 2e32 0d0a Asterisk.1.6.2.. 0x01c0: 4163 6365 7074 3a20 6170 706c 6963 6174 Accept:.applicat 0x01d0: 696f 6e2f 7364 700d 0a43 6f6e 7465 6e74 ion/sdp..Content 0x01e0: 2d4c 656e 6768 743a 2030 0d0a 0d0a -Lenght:.0....
-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/No-failure-messages-in-log-dur... Sent from the freeswitch-users mailing list archive at Nabble.com.
_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com
FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com
Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com
FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org
participants (7)
-
Andrew Cassidy
-
Avi Marcus
-
jay binks
-
Ken Rice
-
Phil Quesinberry
-
PhilQ
-
Steven Ayre