[asterisk-users] Detecting DoS attacks via SIP

[Telium Technical Support]

Keep in mind that the attacks you are seeing in the log are ONLY the ones
that Asterisk is detecting and rejecting.  All other attacks aren't even
showing up!

There's a good discussion of how to secure your PBX here:
https://www.voip-info.org/wiki/view/asterisk+security

In general, don't let the malevolent traffic get as far as the PBX (block at
the firewall).  Also, Digium regularly warns users that fail2ban is NOT a
security system: http://forums.asterisk.org/viewtopic.php?p=159984

-----Original Message-----
From: asterisk-users-bounces at lists.digium.com
[mailto:asterisk-users-bounces at lists.digium.com] On Behalf Of mdiehl
Sent: Tuesday, August 15, 2017 3:38 PM
To: asterisk-users at lists.digium.com
Subject: [asterisk-users] Detecting DoS attacks via SIP

Hi all,

Lately, I've seen an increase in the number of attacks against my system
from the so-called "Friendly Scanner."  When one of these script kiddies
targets my server, all I see for symptoms is a few of my trunks become
lagged due to server load and a stream of messages on the console that
resemble this:

[Aug  2 20:27:50]   == Using SIP VIDEO CoS mark 6
[Aug  2 20:27:50]   == Using SIP RTP TOS bits 24
[Aug  2 20:27:50]   == Using SIP RTP CoS mark 5
[Aug  2 20:32:47]   == Using SIP VIDEO TOS bits 24
[Aug  2 20:32:47]   == Using SIP VIDEO CoS mark 6
[Aug  2 20:32:47]   == Using SIP RTP TOS bits 24
[Aug  2 20:32:47]   == Using SIP RTP CoS mark 5
[Aug  2 20:34:26]   == Using SIP VIDEO TOS bits 24
[Aug  2 20:34:26]   == Using SIP VIDEO CoS mark 6


I have to turn on sip debugging to find out who's hitting me.  However, I
can't just leave it on because it would kill my logging system.

So, how are other people handling this?  Is there an AMI event I want watch
for?  I watch for PeerStatus, but since there's no actual peer in the
attack, I don't seem to get an event from AMI.

Any ideas?

Mike Diehl.

-- 
_____________________________________________________________________
-- Bandwidth and Colocation Provided by http://www.api-digital.com --

Check out the new Asterisk community forum at:
https://community.asterisk.org/

New to Asterisk? Start here:
      https://wiki.asterisk.org/wiki/display/AST/Getting+Started

asterisk-users mailing list
To UNSUBSCRIBE or update options visit:
   http://lists.digium.com/mailman/listinfo/asterisk-users