[asterisk-users] Weird SIP stuff

[James Cloos]

>>>>> "EW" == Eric Wieling <EWieling at nyigc.com> writes:

EW> Basically, the traffic is coming from 65.211.180.237 but the header is:

EW> f: <sip:+1347545xxx at 199.173.94.80:5060;user=phone>;tag=4-45026-159e4a6-995949f-159e4a6

The From: header and the socket ip are often different.

Check for Via: headers.  Those show the path of the SIP.  In your
example, look for a Via which mentions 65.211.180.237.

Note that the From does not necessary have to be a sip address reachable
from the outside.

-JimC
-- 
James Cloos <cloos at jhcloos.com>         OpenPGP: 0x997A9F17ED7DAEA6