[Kamailio-Devel] [ openser-Bugs-2206394 ] Pike module is not working!

[SourceForge.net]

Bugs item #2206394, was opened at 2008-10-29 04:24
Message generated for change (Comment added) made by henningw
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2206394&group_id=139143

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: modules
Group: ver 1.4.x
Status: Open
Resolution: None
Priority: 5
Private: No
Submitted By: arifzaman (arifzaman)
Assigned to: Henning Westerholt (henningw)
Summary: Pike module is not working!

Initial Comment:
Hi,

I’ve configured Kamailio(OpenSER) with Pike module but it’s not working as expected (doesn’t block IP according to the configured time).

Here is a simple configuration by considering the following:
------------------------------------------------------
modparam("pike", "sampling_time_unit", 60) #1 minute
modparam("pike", "reqs_density_per_unit", 200) #200 requests
modparam("pike", "remove_latency", 7200) #Block IP for 2 hours
 
if (!pike_check_req())
    xlog("L_NOTICE","ARIF: TOO MANY HITS FROM $si\n");
    exit;
}
------------------------------------------------------
If the number of SIP messages from a single IP address to my SIP Proxy exceeds 200 per minute. Action: Block IP for 2 hours. 

I’m not sure whether I’m doing wrong or is there any problem with Pike module? 

Please have a look.

Thanks in advance!
ARIF

----------------------------------------------------------------------

>Comment By: Henning Westerholt (henningw)
Date: 2008-11-12 11:41

Message:
Hi Arif,

have you tried to activate the pike logging? It will report then to you
when its block and unblock a IP address. Just set the pike_log_level
parameter to something below your server log level.

I've noticed that the module behaves a little bit others then i expected,
i needed to tune the parameter somewhat to get the behaviour i want. Does
the module fails to block IPs at all? Does it block after the wrong number
of SIP messages, or the wrong time intervall? Does it not remove the
blocked IP addresses from the list?

Henning

----------------------------------------------------------------------

Comment By: arifzaman (arifzaman)
Date: 2008-11-12 07:33

Message:
Hi Henning,

Yes, you are right. I've missed to put bracket in my post. It's a typing
mistake, nothing else.

I've configured OpenSER by considering the following case. But it doesn't
work for me. Could you please check again?

CASE:
If the number of SIP messages from a single IP address to my SIP Proxy
exceeds 200 per minute. Action: Block IP for 2 hours. 

CONFIG:
modparam("pike", "sampling_time_unit", 60) #1 minute
modparam("pike", "reqs_density_per_unit", 200) #200 requests
modparam("pike", "remove_latency", 7200) #Block IP for 2 hours

if (!pike_check_req()) {
  xlog("L_NOTICE","ARIF: TOO MANY HITS FROM $si\n");
  exit;
}

Thanks,
ARIF

----------------------------------------------------------------------

Comment By: Henning Westerholt (henningw)
Date: 2008-11-11 15:01

Message:
Hi Arif,

i did some test with the pike module. I think it works, when the limit is
reached, the request is blocked. I used the same logic as you (althought
you ommit one bracket in your example):

if (!pike_check_req()) {
  xlog("dropped");
  exit;
}

It also remove the IP from the blocking list when the timout is reached.
Can you share a little bit more details what exactly is not working as you
expected?

Thanks,

Henning

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=743020&aid=2206394&group_id=139143