Hello,<div>I run a little IP PBX on Linux in my home with a public IP on a cheap DSL line and often I see this kind of "attack". After having the fail2ban blocked them at firewall level, they still use several KB/s of my slow Internet connection and this it really upsetting me.</div>
<div><br></div><div>I end writing to the abuse department of the provider hosting the server and after one or two days, the flow stops. If you have only few hosts sending probe, make them stop, the world will be a better place...</div>
<div><br></div><div>For now I have dealed with hosting from Europe and US, never found someone from china... maybe they haven't an abuse@ email address.</div><div><br></div><div>I never had to setup a "fight back" strategy, but I think it will acceptable to over flow the host sending probes with hundred of megabits of UDP packets (with a clear payload).</div>
<div><br></div><div>Leandro</div><div><br><div class="gmail_quote">2010/11/26 Peter Childs <span dir="ltr"><<a href="mailto:PChilds@internode.com.au">PChilds@internode.com.au</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<br>
sql> select count(ua) from sip_trace where ua = 'friendly-scanner';<br>
COUNT(UA): 22330<br>
<br>
We get thousands of these scans from all over the joint all the time.<br>
<br>
That is in the last 8 hours...<br>
<br>
sql> select count(fromip), fromip from sip_trace where ua = 'friendly-scanner' group by fromip;<br>
COUNT(FROMIP): 3<br>
FROMIP : 124.195.52.250<br>
<br>
COUNT(FROMIP): 1<br>
FROMIP : 124.254.44.172<br>
<br>
COUNT(FROMIP): 13127<br>
FROMIP : 202.101.187.66<br>
<br>
COUNT(FROMIP): 9199<br>
FROMIP : 74.218.78.29<br>
(4 rows, 10201 ms)<br>
<br>
<br>
I occasionally have discussions with others about <a href="http://tools.ietf.org/html/rfc5635" target="_blank">http://tools.ietf.org/html/rfc5635</a> using some thresholds to block some of these at the border, with the problem being that one day someone will use some cloud platform and we will take out we shouldn't.<br>
<br>
The ACME SBCs we use seem to eat this stuff up ok, but some of the issues we encounter<br>
1. Customers with SIP CPE where a high volume of SIP trash causes the CPE to lock<br>
2. Customers running Asterisk implementations getting cracked and owned<br>
<br>
Cheers,<br>
<font color="#888888"> Peter<br>
</font><div><div></div><div class="h5"><br>
On 26/11/2010, at 1:32 PM, Colin wrote:<br>
<br>
> Tonight i'm seeing hundreds of register attempts per second to one of my SBC's from an IP in china 61.142.250.96.<br>
><br>
> the From: and to: line is always one of these 2 below.<br>
><br>
> \"118\" <sip:118@my SBC IP>; source port 5063<br>
> \"qwerty\" <sip:qwerty@my SBC IP>; source port 5067<br>
><br>
><br>
><br>
> user-agent: friendly-scanner is always.<br>
><br>
> Looks like sipvicious default user agent. Anyone seen a register flood like this before?<br>
><br>
><br>
><br>
> Colin<br>
><br>
><br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> VoiceOps mailing list<br>
> <a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br>
> <a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
<br>
<br>
_______________________________________________<br>
VoiceOps mailing list<br>
<a href="mailto:VoiceOps@voiceops.org">VoiceOps@voiceops.org</a><br>
<a href="https://puck.nether.net/mailman/listinfo/voiceops" target="_blank">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
</div></div></blockquote></div><br></div>