[asterisk-users] chan_sip.c:23647 handle_request_invite: Failed to authenticate device

[motty cruz]

Hello Deepak,

601<sip:601 at 111.118.185.107>;tag=2f498fbd

is the 111.118.185.107 your server IP? it could be a client trying to
authenticate as Rusty suggest or an attacker attempting to gain access, if
you want to find out what IP address that request is coming from do the
following command. make sure you have tcpdump installed.

tcpdump -lni eth0 -f "udp port 5060"

monitor your server to make sure you catch the attacker, also you could do

tcpdump -w capture.cap

and analyze it with wireshark.

Thanks,
Motty

On Thu, Sep 11, 2014 at 2:28 PM, Rusty Newton <rnewton at digium.com> wrote:

> On Thu, Sep 11, 2014 at 10:14 AM, Deepak Bhatia <deepak at voxomos.com>
> wrote:
> > Hi,
> >
> > Why are we getting message in the asterisk
> >
> > [Sep 10 12:55:23] NOTICE[15043]: chan_sip.c:23647 handle_request_invite:
> > Failed to authenticate device 601<sip:601 at 111.118.185.107>;
> > tag=2f498fbd
> > [Sep 10 12:55:24] NOTICE[15043]: chan_sip.c:23647 handle_request_invite:
> > Failed to authenticate device 601<sip:601 at 111.118.185.107>;tag=209a8aa9
> >
> > Regards
> >
> > Deepak Bhatia
>
> Deepak,
>
>  This is commonly a wrong password on the client-side. That is, the
> device attempting to call Asterisk is failing an authentication
> challenge for one reason or another.
>
>  For anyone to help you, you would probably need to post your sip.conf
> configuration (full) and screenshots of your soft/hard client
> configuration.
>
>  Obviously you would want to use a fake password and sanitize IP
> addresses if necessary.
>
> Thanks,
>
> --
> Rusty Newton
> Digium, Inc. | Community Support Manager
> 445 Jan Davis Drive NW - Huntsville, AL 35806 - US
> direct: +1 256 428 6200
>
> Check us out at: http://digium.com & http://asterisk.org
>
> --
> _____________________________________________________________________
> -- Bandwidth and Colocation Provided by http://www.api-digital.com --
> New to Asterisk? Join us for a live introductory webinar every Thurs:
>                http://www.asterisk.org/hello
>
> asterisk-users mailing list
> To UNSUBSCRIBE or update options visit:
>    http://lists.digium.com/mailman/listinfo/asterisk-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20140911/a80a6c63/attachment.html>