Ishfaq is right, that's the way to go.<div>Here's a dialplan line to help you achieve that:</div><div><br></div><div>exten => YOUREXTEN_CHANGE_ME,PRIORITY_CHANGE_ME,Set(CDR(UserField)=SIP HEADER CONTACT: ${SIP_HEADER(CONTACT)}, SIPURI: ${SIPURI}, SIP PEER IP: ${SIPCHANINFO(peerip)}, SIP RECEIVED IP: ${SIPCHANINFO(recvip)}, SIP FROM: ${SIPCHANINFO(from)})</div>
<div><br></div><div>Alex<br><br><div class="gmail_quote">2012/10/5 Ishfaq Malik <span dir="ltr"><<a href="mailto:ish@pack-net.co.uk" target="_blank">ish@pack-net.co.uk</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On Fri, 2012-10-05 at 14:10 +0200, Benoit Panizzon wrote:<br>
> Hello<br>
><br>
> We had this situation:<br>
><br>
> Some bot-net did try to guess SIP logins and finally succeeded. The Asterisk<br>
> Server was abused to call a large number of expensive destinations.<br>
><br>
> It is clear that the sip logins have been passed to various persons (probably<br>
> posted on a forum somewhere inviting to do 'free calls').<br>
><br>
> Right after the affected password was changed, the message log shows which IP<br>
> did try to make calls.<br>
> We also got a few snapshots of 'sip show channels' which show the ip addresses<br>
> of active in call connections.<br>
> So basicly it is known, who abused the service. It was abused from multiple IP<br>
> addresses at the same time.<br>
><br>
> Legal steps against the abusers have been taken, but to claim the costs of the<br>
> damage they generated we would need to know exactly which calls originated<br>
> from which IP address to put an exact sum of damage done by each of the<br>
> abusers.<br>
><br>
> Well for this case it is too late now. But is there a way to get the IP<br>
> Address of the SIP Client being logged in each CDR?<br>
><br>
> Kind regards<br>
><br>
> Benoit Panizzon<br>
><br>
> --<br>
<br>
Hi<br>
<br>
Get info using function SIPCHANINFO<br>
<a href="https://wiki.asterisk.org/wiki/display/AST/Function_SIPCHANINFO" target="_blank">https://wiki.asterisk.org/wiki/display/AST/Function_SIPCHANINFO</a><br>
<br>
Set it to CDR using CDR(userfield)<br>
<br>
The above are for 1.8<br>
<br>
Regards<br>
<br>
Ish<br>
<br>
--<br>
Ishfaq Malik <<a href="mailto:ish@pack-net.co.uk">ish@pack-net.co.uk</a>><br>
Department: VOIP Support<br>
Company: Packnet Limited<br>
t: +44 (0)845 004 4994<br>
f: +44 (0)161 660 9825<br>
e: <a href="mailto:ish@pack-net.co.uk">ish@pack-net.co.uk</a><br>
w: <a href="http://www.pack-net.co.uk" target="_blank">http://www.pack-net.co.uk</a><br>
<br>
Registered Address: PACKNET LIMITED, 2A ENTERPRISE HOUSE, LLOYD STREET<br>
NORTH, MANCHESTER<br>
SCIENCE PARK, MANCHESTER, M156SE<br>
COMPANY REG NO. 04920552<br>
<br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</blockquote></div><br></div>