[Freeswitch-users] Strange CDR entry

Steven Ayre steveayre at gmail.com
Mon May 13 20:28:48 MSD 2013


This is the purpose of the fail2ban system that was already mentioned.

-Steve



On 13 May 2013 15:52, Telecube - John <john at telecube.com.au> wrote:

>  You can install a log watching program that looks out for specific log
> entries and can take action. Eg; writing a firewall rule to ban the ip
> address of the system trying to make unauthorised calls.
>
> 'swatch' is a good tool for this in linux systems.
>
> http://sourceforge.net/projects/swatch/
>
> John
>
> On 14/05/13 12:35 AM, Ken Rice wrote:
>
> Ok look at the 3rd column... This is someone trying to figure out how to
> get calls thru your public context with various prefix codexs... Notices
> how all the calls end with 972598371070 <-- that’s the intl destination
> umber probably a phone in gaza (definitely in Isreali controlled areas, but
> I think I looked up this number or similar number in the past)
>
> To protect yourself, only allow calls to local extentsions from the public
> context...
>
>
> On 5/13/13 2:49 AM, "Steven Ayre" <steveayre at gmail.com> wrote:
>
>  The call duration is 0 seconds so no they didn't get in. Any accepted
> call attempt will generate a CDR even if it was not answered.
>
> They're coming in on the 'public' context which'll mean an unauthenticated
> call on the external profile. That would be the context allowing you to
> receive calls from strangers. Providing that context doesn't allow them to
> dial out via providers that charge you this isn't an issue.
>
> -Steve
>
>
>
>
>
>
> On 13 May 2013 07:17, Bala Murugan Mahendran <b2m at a-cti.com> wrote:
>
> I have lot of entries like 1000,1001,1002 and so on, Is someone trying to
> get inside? I believe they didn't in yet but how come we have cdr log like
> this?
>
> "1004","1004","012972598371070","public","2013-05-12
> 07:30:07","","2013-05-12
> 07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","013972598371070","public","2013-05-12
> 07:30:07","","2013-05-12
> 07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","014972598371070","public","2013-05-12
> 07:30:07","","2013-05-12
> 07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","010972598371070","public","2013-05-12
> 07:30:08","","2013-05-12
> 07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","0061972598371070","public","2013-05-12
> 07:30:08","","2013-05-12
> 07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","0041972598371070","public","2013-05-12
> 07:30:09","","2013-05-12
> 07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","000972598371070","public","2013-05-12
> 07:30:09","","2013-05-12
> 07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","006972598371070","public","2013-05-12
> 07:30:09","","2013-05-12
> 07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","002972598371070","public","2013-05-12
> 07:30:10","","2013-05-12
> 07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729"
> "1004","1004","810972598371070","public","2013-05-12
> 07:29:49","","2013-05-12
> 07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
>
>
> Thanks,
> Bala
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
>
> ------------------------------
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
> --
> Ken
> *http://www.FreeSWITCH.org
> http://www.ClueCon.com
> http://www.OSTAG.org
> *irc.freenode.net #freeswitch
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:consulting at freeswitch.orghttp://www.freeswitchsolutions.com
>
> FreeSWITCH-powered IP PBX: The CudaTel Communication Server
>
> Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com
>
> FreeSWITCH-users mailing listFreeSWITCH-users at lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.freeswitch.org
>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130513/5acaba76/attachment-0001.html 


Join us at ClueCon 2011 Aug 9-11, 2011
More information about the FreeSWITCH-users mailing list