Re: [SR-Users] SIP Attack

2012-04-20 Thread Daniel-Constantin Mierla
Hello, On 4/19/12 2:58 PM, Klaus Darilion wrote: There is something wrong: You show as a SIP response, bu the log files mentions sanity module which can only be used on requests. So, is this the response you are sending back? sanity can be used also for replies, at least in 3.2.x and devel.

Re: [SR-Users] SIP Attack

2012-04-19 Thread Klaus Darilion
There is something wrong: You show as a SIP response, bu the log files mentions sanity module which can only be used on requests. So, is this the response you are sending back? Klaus On 17.04.2012 17:02, Ricardo Martinez wrote: Hello. I was wondering if someone could help me here. From ti

Re: [SR-Users] SIP Attack

2012-04-19 Thread Daniel-Constantin Mierla
Hello, I see the message gets to the config file, hitting sanity module. What you can do is to use fail2ban for automatic interaction with iptables -- you can inspire from this tutorial: * http://kb.asipto.com/kamailio:usage:k31-sip-scanning-attack#fail2ban You will just have a different c

Re: [SR-Users] SIP Attack

2012-04-17 Thread Reda Aouad
Hi, Do you have any client that is sending a corrupt request to the "AddPac SIP Gateway" at 190.22.140.170, so that this gateway is replying "400 bad request" ? Maybe you could resolve this problem at the source.. If it's not the case, you can send an email to the owner of the IP address. A quick

Re: [SR-Users] SIP Attack

2012-04-17 Thread Vineet Menon
IMHO preventing the packet to reach kamailio is better (via iptables) than doing something in kamailio itself Regards, Vineet Menon On 17 April 2012 20:32, Ricardo Martinez wrote: > Hello. > > I was wondering if someone could help me here. From time to time I stat > to receive from the

[SR-Users] SIP Attack

2012-04-17 Thread Ricardo Martinez
Hello. I was wondering if someone could help me here. From time to time I stat to receive from the internet this SIP message : U 190.22.140.170:51316 -> 64.76.154.110:5060 SIP/2.0 400 BadRequest. Via: . From: . To: . Call-ID: . CSeq: . User-Agent: AddPac SIP Gateway. Content-Length: 0.