<div dir="ltr"><div> if ($ua =~ "friendly-scanner") {</div><div> xlog("L_ERR", "Attack attempt - Request dropped");</div><div> drop();</div><div> }</div>
<div class="gmail_extra"><br clear="all"><div style>--</div><div style>Nick<br></div><br><div class="gmail_quote">2013/3/6 leo <span dir="ltr"><<a href="mailto:uzcudunl@yahoo.it" target="_blank">uzcudunl@yahoo.it</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello:<br>
<br>
I'm receiving on my OpenSIPS server a lot of register request. I believe<br>
that is someone trying to attack the sip service because the source IP is<br>
not one that i know. Here is the request:<br>
<br>
10:03:54.191249 00:08:e3:20:fb:b6 > 00:0c:29:fc:95:e1, ethertype IPv4<br>
(0x0800), length 384: (tos 0x0, ttl 52, id 0, offset 0, flags [DF], proto<br>
UDP (17), length 370)<br>
199.217.115.214.5981 > X.X.X.X.5060: [udp sum ok] SIP, length: 342<br>
REGISTER sip:X.X.X.X SIP/2.0<br>
Via: SIP/2.0/UDP 199.217.115.214:5981;branch=z9hG4bK-2684304106;rport<br>
Content-Length: 0<br>
From: "5988" <sip:5988@X.X.X.X><br>
Accept: application/sdp<br>
User-Agent: friendly-scanner<br>
To: "5988" <sip:5988@X.X.X.X><br>
Contact: <a href="mailto:sip%3A123@1.1.1.1">sip:123@1.1.1.1</a><br>
CSeq: 1 REGISTER<br>
Call-ID: 3943182463<br>
Max-Forwards: 70<br>
<br>
How could i prevent this kind of requests?<br>
Thanks a lot.<br>
<br>
Leo.<br>
<br>
<br>
<br>
--<br>
View this message in context: <a href="http://opensips-open-sip-server.1449251.n2.nabble.com/How-to-protect-OpenSIPS-from-undesidered-requests-DoS-attack-tp7585091.html" target="_blank">http://opensips-open-sip-server.1449251.n2.nabble.com/How-to-protect-OpenSIPS-from-undesidered-requests-DoS-attack-tp7585091.html</a><br>
Sent from the OpenSIPS - Users mailing list archive at Nabble.com.<br>
<br>
_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.opensips.org">Users@lists.opensips.org</a><br>
<a href="http://lists.opensips.org/cgi-bin/mailman/listinfo/users" target="_blank">http://lists.opensips.org/cgi-bin/mailman/listinfo/users</a><br>
</blockquote></div><br></div></div>