I would block the IP address using iptables On Fri, Jun 27, 2014 at 2:02 PM, Robert Newberry <N1XBM@amsat.org> wrote:
I also googled the IP and I'm coming up with India...slightly confused on that.
On Fri, Jun 27, 2014 at 2:57 PM, Robert Newberry <N1XBM@amsat.org> wrote:
OK so I found the offending IP address out of South Brisdane, Queensland. They are just going thru 4 digit extensions one by one, they file is quite large. What should I do next? Block the IP and report it?
On Fri, Jun 27, 2014 at 2:00 PM, DARN SIMPLE | N0PCO < n0pco@darnsimple.net> wrote:
As most would say "you're dealing with script kiddies" people that are trying to find a free route for the calls among other mischievous things.
-----------------
Check the file /var/log/asterisk/messages for some helpful clues where the attempts are coming from.
Look for SECURITY[numbercode] there should be some ip addresses on the same line.
You can find out more about the ip address and the subnet involved by going to: http://mxtoolbox.com/arin.aspx and enter the ip address.
Do you know how to set up the iptable rules?
------------------
It's more of a nuisance than anything else. Still a good idea to learn how to use iptables, it will make things easier in the long run.
Mars
On 06/27/2014 11:59 AM, Robert Newberry wrote:
Can anyone tell me what this means in my CLI?
[Jun 27 12:47:44] NOTICE[2177]: chan_sip.c:14418 handle_request_invite: Call from '' to extension '+901148422885410' rejected because extension not found. [Jun 27 12:48:04] WARNING[2177]: chan_sip.c:1964 retrans_pkt: Maximum retries exceeded on transmission 768cac067094ca767d045f9ac57d60d3 for seqno 1 (Critical Response) -- See doc/sip-retransmit.txt. N1XBM*CLI>
So I do have to extensions setup one is my tablet (which is off) I also have my cell phone (which I have in airplane mode). Is someone trying to hack my server?
Thank you
_______________________________________________ App_rpt-users mailing list App_rpt-users@ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.