[asterisk-dev] Better logging for SIP attacks

Stefan Schmidt sst at sil.at
Fri Jul 22 01:23:51 CDT 2011


Am 22.07.11 07:51, schrieb Philip Prindeville:
> I'm looking at the following:
> 
</snip>
> 
> And thinking that without an IP address, I can't contact the abuser's ISP, but to get that I'd have to turn on SIP debugging, which on a fairly busy switch would just be too noisy.
> 
> Should more information be logged with this?
> 
> -Philip

Hello Philip,

You can use something like Channel(peerip) to see from which source ip
these calls come.

for exampe:
[INVALID]

exten => _!,1,Noop(invalid exten from ${CHANNEL(peerip)})
same => n,hangup

i dont think we need to change something in the source code for this case.

best regards

stefan





More information about the asterisk-dev mailing list