[Freeswitch-users] Strange CDR entry

Telecube - John john at telecube.com.au
Mon May 13 21:16:11 MSD 2013


Yep, fail2ban is another option.. it's nice to have options..   ;-)

-John

On 14/05/13 2:28 AM, Steven Ayre wrote:
> This is the purpose of the fail2ban system that was already mentioned.
>
> -Steve
>
>
>
> On 13 May 2013 15:52, Telecube - John <john at telecube.com.au 
> <mailto:john at telecube.com.au>> wrote:
>
>     You can install a log watching program that looks out for specific
>     log entries and can take action. Eg; writing a firewall rule to
>     ban the ip address of the system trying to make unauthorised calls.
>
>     'swatch' is a good tool for this in linux systems.
>
>     http://sourceforge.net/projects/swatch/
>
>     John
>
>     On 14/05/13 12:35 AM, Ken Rice wrote:
>>     Ok look at the 3rd column... This is someone trying to figure out
>>     how to get calls thru your public context with various prefix
>>     codexs... Notices how all the calls end with 972598371070 <--
>>     that's the intl destination umber probably a phone in gaza
>>     (definitely in Isreali controlled areas, but I think I looked up
>>     this number or similar number in the past)
>>
>>     To protect yourself, only allow calls to local extentsions from
>>     the public context...
>>
>>
>>     On 5/13/13 2:49 AM, "Steven Ayre" <steveayre at gmail.com
>>     <http://steveayre@gmail.com>> wrote:
>>
>>         The call duration is 0 seconds so no they didn't get in. Any
>>         accepted call attempt will generate a CDR even if it was not
>>         answered.
>>
>>         They're coming in on the 'public' context which'll mean an
>>         unauthenticated call on the external profile. That would be
>>         the context allowing you to receive calls from strangers.
>>         Providing that context doesn't allow them to dial out via
>>         providers that charge you this isn't an issue.
>>
>>         -Steve
>>
>>
>>
>>
>>
>>
>>         On 13 May 2013 07:17, Bala Murugan Mahendran <b2m at a-cti.com
>>         <http://b2m@a-cti.com>> wrote:
>>
>>             I have lot of entries like 1000,1001,1002 and so on, Is
>>             someone trying to get inside? I believe they didn't in
>>             yet but how come we have cdr log like this?
>>
>>             "1004","1004","012972598371070","public","2013-05-12
>>             07:30:07","","2013-05-12
>>             07:30:07","0","0","NORMAL_CLEARING","c522fb02-bad5-11e2-8eaf-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","013972598371070","public","2013-05-12
>>             07:30:07","","2013-05-12
>>             07:30:07","0","0","NORMAL_CLEARING","c5571b44-bad5-11e2-8eb3-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","014972598371070","public","2013-05-12
>>             07:30:07","","2013-05-12
>>             07:30:07","0","0","NORMAL_CLEARING","c58eb428-bad5-11e2-8eb7-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","010972598371070","public","2013-05-12
>>             07:30:08","","2013-05-12
>>             07:30:08","0","0","NORMAL_CLEARING","c5c42d4c-bad5-11e2-8ebb-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","0061972598371070","public","2013-05-12
>>             07:30:08","","2013-05-12
>>             07:30:08","0","0","NORMAL_CLEARING","c5fe993c-bad5-11e2-8ebf-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","0041972598371070","public","2013-05-12
>>             07:30:09","","2013-05-12
>>             07:30:09","0","0","NORMAL_CLEARING","c63f939c-bad5-11e2-8ec3-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","000972598371070","public","2013-05-12
>>             07:30:09","","2013-05-12
>>             07:30:09","0","0","NORMAL_CLEARING","c67a9f5a-bad5-11e2-8ec7-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","006972598371070","public","2013-05-12
>>             07:30:09","","2013-05-12
>>             07:30:09","0","0","NORMAL_CLEARING","c6afc2fc-bad5-11e2-8ecb-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","002972598371070","public","2013-05-12
>>             07:30:10","","2013-05-12
>>             07:30:10","0","0","NORMAL_CLEARING","c6ec0b5e-bad5-11e2-8ecf-7bfd76dfd5d7","","","G729","G729"
>>             "1004","1004","810972598371070","public","2013-05-12
>>             07:29:49","","2013-05-12
>>             07:29:49","0","0","NORMAL_CLEARING","ba7999a4-bad5-11e2-8b6f-7bfd76dfd5d7","","","G729","G729"
>>
>>
>>             Thanks,
>>             Bala
>>
>>             _________________________________________________________________________
>>             Professional FreeSWITCH Consulting Services:
>>             consulting at freeswitch.org <http://consulting@freeswitch.org>
>>             http://www.freeswitchsolutions.com
>>
>>             
>>             
>>
>>             Official FreeSWITCH Sites
>>             http://www.freeswitch.org
>>             http://wiki.freeswitch.org
>>             http://www.cluecon.com
>>
>>             FreeSWITCH-users mailing list
>>             FreeSWITCH-users at lists.freeswitch.org
>>             <http://FreeSWITCH-users@lists.freeswitch.org>
>>             http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>             UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>             http://www.freeswitch.org
>>
>>
>>
>>         ------------------------------------------------------------------------
>>         _________________________________________________________________________
>>         Professional FreeSWITCH Consulting Services:
>>         consulting at freeswitch.org <http://consulting@freeswitch.org>
>>         http://www.freeswitchsolutions.com
>>
>>         
>>         
>>
>>         Official FreeSWITCH Sites
>>         http://www.freeswitch.org
>>         http://wiki.freeswitch.org
>>         http://www.cluecon.com
>>
>>         FreeSWITCH-users mailing list
>>         FreeSWITCH-users at lists.freeswitch.org
>>         <http://FreeSWITCH-users@lists.freeswitch.org>
>>         http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>         UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>         http://www.freeswitch.org
>>
>>
>>     -- 
>>     Ken
>>     _http://www.FreeSWITCH.org
>>     http://www.ClueCon.com
>>     http://www.OSTAG.org
>>     _irc.freenode.net <http://irc.freenode.net> #freeswitch
>>
>>
>>     _________________________________________________________________________
>>     Professional FreeSWITCH Consulting Services:
>>     consulting at freeswitch.org  <mailto:consulting at freeswitch.org>
>>     http://www.freeswitchsolutions.com
>>
>>     
>>     
>>
>>     Official FreeSWITCH Sites
>>     http://www.freeswitch.org
>>     http://wiki.freeswitch.org
>>     http://www.cluecon.com
>>
>>     FreeSWITCH-users mailing list
>>     FreeSWITCH-users at lists.freeswitch.org  <mailto:FreeSWITCH-users at lists.freeswitch.org>
>>     http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>>     UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>>     http://www.freeswitch.org
>
>
>     _________________________________________________________________________
>     Professional FreeSWITCH Consulting Services:
>     consulting at freeswitch.org <mailto:consulting at freeswitch.org>
>     http://www.freeswitchsolutions.com
>
>     
>     
>
>     Official FreeSWITCH Sites
>     http://www.freeswitch.org
>     http://wiki.freeswitch.org
>     http://www.cluecon.com
>
>     FreeSWITCH-users mailing list
>     FreeSWITCH-users at lists.freeswitch.org
>     <mailto:FreeSWITCH-users at lists.freeswitch.org>
>     http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
>     UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
>     http://www.freeswitch.org
>
>
>
>
> _________________________________________________________________________
> Professional FreeSWITCH Consulting Services:
> consulting at freeswitch.org
> http://www.freeswitchsolutions.com
>
> 
> 
>
> Official FreeSWITCH Sites
> http://www.freeswitch.org
> http://wiki.freeswitch.org
> http://www.cluecon.com
>
> FreeSWITCH-users mailing list
> FreeSWITCH-users at lists.freeswitch.org
> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users
> UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users
> http://www.freeswitch.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.freeswitch.org/pipermail/freeswitch-users/attachments/20130514/5b3bc652/attachment-0001.html 


Join us at ClueCon 2011 Aug 9-11, 2011
More information about the FreeSWITCH-users mailing list