Re: [SR-Users] Retrieve remote IP and port

Hi Arsen, Someone keeps sending INVITEs to my kamailio box with the |From:| and |To:| IPs set to the Kamailio box’s public IP. I have |fail2ban| that tracks a log file and bans the IP when pike blocks a request 3 times. However, the IP that pops up in the log file is the server’s own IP address and not the sender’s IP address. So let’s say my kamailio box is at 1.2.3.4. I get the following in the log: |ALERT: <script>: Pike block INVITE from sip:7774@1.2.3.4 (IP 1.2.3.4:5080) | Which comes from this snippet from my kamailio.cfg: |if (!pike_check_req()) { xlog("L_ALERT","Pike block $rm from $fu (IP $si:$sp)\n"); exit; } | This rogue INVITE is certainly not coming from my own server. Running tcpdump with header shows the IP of the culprit - |195.154.172.167|. That can also be seen in the Via: header below. I know I can block the sipcli UA, but I’m not comfortable with being unable to log the IP address of the sender in case they spoof the UA. |INVITE sip:+443331010095@1.2.3.4:5080 SIP/2.0 To: +443331010095<sip:+443331010095@1.2.3.4> From: 7008<sip:7008@1.2.3.4>;tag=7650baf5 Via: SIP/2.0/UDP 195.154.172.167:5074;branch=z9hG4bK-79da852e8e37dc3f58a5f098a089d5b5;rport Call-ID: 79da852e8e37dc3f58a5f098a089d5b5 CSeq: 1 INVITE Contact: <sip:7008@195.154.172.167:5074> Max-Forwards: 70 Allow: INVITE, ACK, CANCEL, BYE User-Agent: sipcli/v1.8 Content-Type: application/sdp Content-Length: 286 | So I cannot understand why does $si show 1.2.3.4 instead of the culprit’s IP address? Hope this makes more sense! Kind regards, Iskren Hadzhinedev On 29/09/17 13:38, Arsen wrote: ​