| Author |
Message |
ndxbach
Brekeke Junior Member
Joined: 04 Sep 2014
Posts: 9
Location: Vietnam
|
 Posted: Thu Sep 04, 2014 1:42 pm Post subject: Appearance strange account sip when call, |
 |
|
1. Brekeke Product Name and Version:
3.3.4.4 Advanced
2. Java version:
1.8.0_11
3. OS type and the version:
Windows Server 2012 R2, version 6.3
4. UA (phone), gateway or other hardware/software involved:
doubango r1025, imsdroid android app.
5. Your problem:
I use software as IMSdroid. I use LG android phone to call to Sony android phone. Sometime, it fails. When it fails, I read error logs on the sip server and see strange account appearence as:
From url: sip:101@54.187.231.181
To url: sip:110972599993825@54.187.231.181
User Agent: sipcli/v1.8.
Please explain to me reason occur and the method to solve.
Thank you.
_________________
NDXBach |
|
| Back to top |
|
ambrosio
Brekeke Master Guru
Joined: 27 Mar 2008
Posts: 215
|
| Posted: Thu Sep 04, 2014 6:15 pm Post subject: |
|
|
> From url: sip:101@54.187.231.181
> To url: sip:110972599993825@54.187.231.181
Are they valid SIP URI in your service?
If not, it will be a SIP attacking.
Add the following DialPlan rule in the [Dial Plan] -> [Preliminary] page.
| Matching Patterns | User-Agent = sipcli
| | Deploy Patterns | $action = block
|
FYI:
http://wiki.brekeke.com/wiki/Block-List-Honeypot |
|
| Back to top |
|
ndxbach
Brekeke Junior Member
Joined: 04 Sep 2014
Posts: 9
Location: Vietnam
|
| Posted: Thu Sep 04, 2014 6:48 pm Post subject: |
|
|
| ambrosio wrote: |
> From url: sip:101@54.187.231.181
> To url: sip:110972599993825@54.187.231.181
Are they valid SIP URI in your service?
|
No, they are invalid SIP URI.
| ambrosio wrote: |
If not, it will be a SIP attacking.
Add the following DialPlan rule in the [Dial Plan] -> [Preliminary] page.
| Matching Patterns | User-Agent = sipcli
| | Deploy Patterns | $action = block
|
FYI:
http://wiki.brekeke.com/wiki/Block-List-Honeypot |
I tried as your advice. I will check it.
Thank you
_________________
NDXBach |
|
| Back to top |
|
taitan
Brekeke Master Guru
Joined: 15 Mar 2008
Posts: 237
|
| Posted: Fri Sep 05, 2014 9:13 am Post subject: |
|
|
> User Agent: sipcli/v1.8.
sipcli is one of common attacking tools. |
|
| Back to top |
|
ndxbach
Brekeke Junior Member
Joined: 04 Sep 2014
Posts: 9
Location: Vietnam
|
| Posted: Sun Sep 07, 2014 9:54 am Post subject: |
|
|
| taitan wrote: |
> User Agent: sipcli/v1.8.
sipcli is one of common attacking tools. |
Hi Taitan.Which other attacking tools do I need to alert?
Thank you.
_________________
NDXBach |
|
| Back to top |
|
taitan
Brekeke Master Guru
Joined: 15 Mar 2008
Posts: 237
|
|
| Back to top |
|
|
