First of all,<div>This is an attack from sipvicious. It is an *attack*. It will be very high rate (cps) and you do *not* want to use anything that consumes resources to attempt to block it.</div><div><br></div><div>First recommendation is to use iptables. In addition, you *should* put a check in your config for friendly-scanner and drop() the packet. Do not reply with a sip code. You want to be invisible to the attacker. If you reply with a sip code, they'll just scan you attempting to find a request combination that will return a usable result. </div>
<div><br></div><div>1. Do whatever you can to not use CPU resources to block this</div><div>2. Don't look like a SIP server to source IPs you do not recognize</div><div><br></div><div>I guarantee, if you look like a SIP server, you will get brutally attacked from unsolicited sources. </div>
<div><br></div><div>Read up on the fail2ban docs for asterisk. They have some good ideas in there on how to perform intrusion detection and how to automatically add offending traffic to fail2ban. You can do something similar in OpenSIPs. </div>
<div><br></div><div>I would be very curious to hear about other people's experiences using the Pike module to block this type of traffic. For what it's worth, I've seen attack traffic high enough in bandwidth to saturate a pretty beefy internet connection and I've even seen it crash routers. If you can avoid them finding you in the first place, that would be a much better option. </div>
<div>-Brett</div><div><br><br><div class="gmail_quote">On Mon, Oct 8, 2012 at 7:53 AM, Engineer voip <span dir="ltr"><<a href="mailto:forvoip4@gmail.com" target="_blank">forvoip4@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<font color="#000066"><font face="comic sans ms,sans-serif">Hi,<br>I'm trying to use pike module and i'm using the script above, but when i execute this command " opensipsctl fifo pike_list"<br>i don't get any address blocked<br>
My opensips config is:<br><br>loadmodule "pike.so"<br>modparam("pike", "sampling_time_unit", 10)<br>modparam("pike", "reqs_density_per_unit", 30)<br>modparam("pike", "remove_latency", 120)<br>
modparam("pike", "check_route","pike") # enable automatic checking<br>modparam("pike", "pike_log_level",1)<br><br>route[pike]<br>{<br> if (src_ip==x.x.x.x ||src_ip==gw_ip) # Trusted IP<br>
xlog("L_INFO", "in pike route ");<br> drop();<br>}<br><br>have you an idea please toresolve that?<br></font></font><div class="HOEnZb"><div class="h5"><br><div class="gmail_quote">2012/10/8 SamyGo <span dir="ltr"><<a href="mailto:govoiper@gmail.com" target="_blank">govoiper@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p>Hi,<br>
Relax it says its Friendly !! </p>
<p>But still if you want to block it you've many options i.e in opensips.cfg start put a condition $ua =~ "friendly-scanner". If matched return stateless some error.<br>
Other option is to use pike module.<br>
Another option is use fail2ban for opensips logs. <br>
More sophisticated options involve firewalls with IPS and IDS modules.</p>
<p>I hope it was helpful.</p>
<p>BR<br>
Sammy<br>
</p>
<div class="gmail_quote"><div><div>On Oct 8, 2012 2:33 PM, "Engineer voip" <<a href="mailto:forvoip4@gmail.com" target="_blank">forvoip4@gmail.com</a>> wrote:<br type="attribution"></div></div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div>
<font face="comic sans ms,sans-serif">Hi All,<br>I receveid several packets </font><font face="comic sans ms,sans-serif"><font face="comic sans ms,sans-serif"> of registration </font>from a </font><font face="comic sans ms,sans-serif"> "friendly-scanner" on my opensips server<br>
how can i do to block that please??<br clear="all"></font><br>-- <br><font color="#663300"><font face="comic sans ms,sans-serif"><br><span>Best Regards.</span><br></font></font><br><br>
<br></div></div>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br></blockquote></div>
<br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org" target="_blank">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br></blockquote></div><br><br clear="all"><br></div></div><span class="HOEnZb"><font color="#888888">-- <br><font color="#663300"><font face="comic sans ms,sans-serif"><br><span style>Best Regards.</span><br></font></font><br>
<br>
</font></span><br>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
<br></blockquote></div><br></div>