[SR-Users] [KAMAILIO]: How to count three or more invalid REGISTERs from the same IP-address
Sergey Okhapkin
sos at sokhapkin.dyndns.org
Sun Jun 19 20:22:41 CEST 2016
Log error message on unsuccessful REGISTER and let fail2ban do the rest.
Anyway you're running fail2ban, don't you?
On Sunday 19 June 2016 21:19:42 Яцко Эллад Геннадьевич wrote:
> Hello!
>
> How to detect several unsuccessful REGISTER attempts from the same IP?
>
> For example: a malicious user tries to look for passwords, can I detect
> this in some way to black list it? As you know there are different SIP
> dialogs here.. I need to mention these attempts should be counted
> during certain period of time (e. g. 1 minute). If there were ONLY TWO
> attempts for 1 minute the counter need to be reset to zero.
>
> I've read about PERMISSIONS/BLST, but they don't offer such a mechanism.
>
> I'll be waiting for your help, guys! :-)
>
> Kind regards,
> Ellad
>
> _______________________________________________
> SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list
> sr-users at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users
More information about the sr-users
mailing list