[asterisk-users] Weird IPs in Fail2ban list

[Barry Miller]

On Thu, Jan 26, 2012 at 11:49:32PM -0500, asterisk jobs wrote:
> Hello everyone,
> 
> I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen
> this or can explain this?
> 
> Chain fail2ban-ASTERISK (1 references)
> num  target     prot opt source               destination
> 1    DROP       all  --  0.23.20.189          0.0.0.0/0
> 
> I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when I
> am testing. Are these numbers taken from the SIP packet or the TCP/IP
> protocol source because they surely are not valid addresses.
> 
> Thanks

See fail2ban-regex(1).  It's very useful for discovering what fail2ban
makes of your log files.

-- 
Barry