26 Nov
2013
26 Nov
'13
4:59 p.m.
Hello
please follow this link
http://kb.asipto.com/kamailio:usage:k31-sip-scanning-attack this is a good
tuturial about preventing sip attack's
Regards
2013/11/26 Joli Martinez <mrjoli021(a)gmail.com>
How can I do this? Is there an article I can
reference or something? I
am new to kamailio and not sure how to do this.
Thanks,
On Nov 26, 2013, at 4:41 PM, Ovidiu Sas <osas(a)voipembedded.com> wrote:
--
VoIP Embedded, Inc.
http://www.voipembedded.com
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
Cumprimentos
José Seabra
Google around for "friendly-scanner" to
learn more about it.
In the mean time, allow the packets to be handled by kamailio and send
a 200ok back - maybe this will stop the attack.
After the attack is stopped, simply drop all "friendly-scanner" SIP
requests :)
Regards,
Ovidiu Sas
On Tue, Nov 26, 2013 at 4:32 PM, Joli Martinez <mrjoli021(a)gmail.com>
wrote:
> it is comming from
"friendly-scanner" The other issue I have is that
"/var/log/secure" is not getting the sip requests so the only way I realize
it is happeing is from tcpdump. If the secure file is not picking it up
then iptables wont know about it. How can I tell iptables to listen for
sip requests? I have already added the IP to the blocked IP's but he still
keeps on comming.
>
> Thanks,
>
> On Nov 26, 2013, at 4:28 PM, Ovidiu Sas <osas(a)voipembedded.com> wrote:
>
>> Most likely it's a bogus script.
>> Sometimes just sending a dummy reply, will stop the script sending SIP
requests.
>> Check the User-Agent header and from
username to see if you can
>> identify the script and google around for it.
>>
>> Regards,
>> Ovidiu Sas
>>
>> On Tue, Nov 26, 2013 at 4:17 PM, Joli Martinez <mrjoli021(a)gmail.com>
wrote:
>>> I am running Kamailio in CentOS. I
ran tcpdump and noticed that we
are getting attacked from IP 188.138.32.72. I have
already blocked it on
IPtables, but he keeps on attacking the server. If I look at
"/var/log/secure" there are no SIP messages. My question is where is the
log file for Kamailio and how can I prevent this type of attacks in the
future.
>>>
>>> Thanks,
>>> _______________________________________________
>>> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing
list
> sr-users(a)lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
--
VoIP Embedded, Inc.
http://www.voipembedded.com
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
_______________________________________________
SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
sr-users(a)lists.sip-router.org
http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users