[VoiceOps] Voice DDOS ?

[Ivan Kovacevic]

Calls are coming to us via L3 (along with all the legitimate traffic) so
simple IP block won't be helpful. We've disconnected the number to make it
stop... but this is only possible because the number was not in use.

If it was an active number, we wouldn't have this option. Just chatting
with L3 to see what options they have for this type of scenario.

Best Regards,

Ivan

-----Original Message-----
From: John Curry [mailto:John at InteleChoice.us]
Sent: Monday, February 24, 2014 9:51 AM
To: 'Christopher Aloi'; 'Ivan Kovacevic'
Cc: voiceops at voiceops.org
Subject: RE: [VoiceOps] Voice DDOS ?

I would just block the originating IP address. It would appear to me
someone is trying to compromise your system.

-----Original Message-----
From: VoiceOps [mailto:voiceops-bounces at voiceops.org] On Behalf Of
Christopher Aloi
Sent: Monday, February 24, 2014 9:44 AM
To: Ivan Kovacevic
Cc: voiceops at voiceops.org
Subject: Re: [VoiceOps] Voice DDOS ?


Sounds like a possible loop, the "No Routes Found" recording comes off of
a Sonus Networks GSX or SBC.

How is the TFN arriving to your network?

- Chris



On 24 Feb 2014, at 9:01, Ivan Kovacevic wrote:

> Hi Folks,
>
>
>
> We are seeing something strange coming across our network. A
> disconnected client TFN is receiving 30,000+ calls per hour (all
> failing). The ANIs being used are dummy ANIs 17029983416 (no answer)
> and 16469820093 (recording saying "no routes found").
>
>
>
> This is not affecting our network, although it's causing the upstream
> provider a bit of grief.
>
>
>
> Not sure why someone would do this.... We are about to remove the CICs
> at the
> sms800 level, but just wondering if anyone has come across something
> similar?
>
>
>
> Thanks,
>
>
>
> Ivan
> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops
_______________________________________________
VoiceOps mailing list
VoiceOps at voiceops.org
https://puck.nether.net/mailman/listinfo/voiceops