This is probably a sipvicious or similar scan looking for open sip servers to terminate illicit traffic... There are numerous posts in the list archives on this subject (and the list archives are heavily indexed by google). Check out fail2ban and related wiki articles also... Another way to limit this traffic is if you know all the netblocks only allow sip traffic from those in IP Tables... Or filter those via the various FS mechanisms... K On 12/9/13 6:39 PM, "stephen@picardogroup.com" <stephen@picardogroup.com> wrote:

Have an existing FS app using 800 inbound with SIP carrier. No IP address is sent.

Below is example of good call with proper ANI and DNIS sent from our carrier. (Modified to protect info.)

12:27:43 lsvc:Inbound call from ANI xxxxxxxxxx to DNIS 800xxxxxxx 12:27:44 (121094) lsvc:SERVER_TYPE is: 0 12:27:44 (121093) lsvc:Staff 2 logged in 12:27:47 (121094) lsvc:Caller is entering his phone number 12:27:48 (121093) lsvc:disconnected reason was NONE 12:27:48 (121093) lsvc:lsvc_in: completed call successfully 12:27:52 (121094) lsvc:The caller typed in a home phone number of xxxxxxxxxx

Below is example of hits we are taking that are not being sent from our carrier (I assume direct hits to router)

10:00:12 lsvc:Inbound call from ANI 100 to DNIS 001448703928456 10:00:13 (121218) lsvc:SERVER_TYPE is: 0 10:00:45 (121218) lsvc:disconnected reason was NONE 10:00:45 (121218) lsvc:Caller is entering his phone number

My question is there a way for me to prevent the fake ANI's from connecting?

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org G+ ClueCon : http://fs0.us/cluecon-gplus FB ClueCon : http://fs0.us/cluecon-fb G+ FreeSwitch : http://fs0.us/freeswitch-gplus FB FreeSWITCH : http://fs0.us/freeswitch-fb Twitter : @FreeSWITCH_WIRE irc.freenode.net #freeswitch