<div dir="ltr">Hello Deepak, <div><br></div><div><span style="font-family:arial,sans-serif;font-size:13px">601<</span><a href="mailto:sip%3A601@111.118.185.107" target="_blank" style="font-family:arial,sans-serif;font-size:13px">sip:601@111.118.185.107</a><span style="font-family:arial,sans-serif;font-size:13px">>;</span><span style="font-family:arial,sans-serif;font-size:13px">tag=2f498fbd</span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><font face="arial, sans-serif">is the 111.118.185.107 your server IP? it could be a client trying to authenticate as Rusty suggest or an attacker attempting to gain access, if you want to find out what IP address that request is coming from do the following command. make sure you have tcpdump installed. </font></div><div><br></div><div><span style="font-family:Calibri,sans-serif;font-size:15px"><font face="Calibri"><span style="font-size:11pt">tcpdump</span></font></span><span style="font-family:Calibri,sans-serif;font-size:15px"> -</span><span style="font-family:Calibri,sans-serif;font-size:15px">lni</span><span style="font-family:Calibri,sans-serif;font-size:15px"> eth0 -f "</span><span style="font-family:Calibri,sans-serif;font-size:15px">udp</span><span style="font-family:Calibri,sans-serif;font-size:15px"> port 5060"</span><br></div><div><span style="font-family:Calibri,sans-serif;font-size:15px"><br></span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px">monitor your server to make sure you catch the attacker, also you could do </span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px"><br></span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px">tcpdump -w capture.cap </span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px"><br></span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px">and analyze it with wireshark. </span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px"><br></span></div><div><span style="font-family:Calibri,sans-serif;font-size:15px">Thanks, <br>Motty</span></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 11, 2014 at 2:28 PM, Rusty Newton <span dir="ltr"><<a href="mailto:rnewton@digium.com" target="_blank">rnewton@digium.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Thu, Sep 11, 2014 at 10:14 AM, Deepak Bhatia <<a href="mailto:deepak@voxomos.com">deepak@voxomos.com</a>> wrote:<br>
> Hi,<br>
><br>
> Why are we getting message in the asterisk<br>
><br>
> [Sep 10 12:55:23] NOTICE[15043]: chan_sip.c:23647 handle_request_invite:<br>
> Failed to authenticate device 601<<a href="mailto:sip%3A601@111.118.185.107">sip:601@111.118.185.107</a>>;<br>
> tag=2f498fbd<br>
> [Sep 10 12:55:24] NOTICE[15043]: chan_sip.c:23647 handle_request_invite:<br>
> Failed to authenticate device 601<<a href="mailto:sip%3A601@111.118.185.107">sip:601@111.118.185.107</a>>;tag=209a8aa9<br>
><br>
> Regards<br>
><br>
> Deepak Bhatia<br>
<br>
</div></div>Deepak,<br>
<br>
This is commonly a wrong password on the client-side. That is, the<br>
device attempting to call Asterisk is failing an authentication<br>
challenge for one reason or another.<br>
<br>
For anyone to help you, you would probably need to post your sip.conf<br>
configuration (full) and screenshots of your soft/hard client<br>
configuration.<br>
<br>
Obviously you would want to use a fake password and sanitize IP<br>
addresses if necessary.<br>
<br>
Thanks,<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Rusty Newton<br>
Digium, Inc. | Community Support Manager<br>
445 Jan Davis Drive NW - Huntsville, AL 35806 - US<br>
direct: <a href="tel:%2B1%20256%20428%206200" value="+12564286200">+1 256 428 6200</a><br>
<br>
Check us out at: <a href="http://digium.com" target="_blank">http://digium.com</a> & <a href="http://asterisk.org" target="_blank">http://asterisk.org</a><br>
<br>
--<br>
_____________________________________________________________________<br>
-- Bandwidth and Colocation Provided by <a href="http://www.api-digital.com" target="_blank">http://www.api-digital.com</a> --<br>
New to Asterisk? Join us for a live introductory webinar every Thurs:<br>
<a href="http://www.asterisk.org/hello" target="_blank">http://www.asterisk.org/hello</a><br>
<br>
asterisk-users mailing list<br>
To UNSUBSCRIBE or update options visit:<br>
<a href="http://lists.digium.com/mailman/listinfo/asterisk-users" target="_blank">http://lists.digium.com/mailman/listinfo/asterisk-users</a><br>
</font></span></blockquote></div><br></div>