<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">I have placed the code below right underneath the route portion in the kamailio.cfg file restarted kamailio and I am still being attacked.<div><br></div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo; color: rgb(77, 44, 220); background-color: rgb(254, 244, 156);">####### Routing Logic ########</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156); min-height: 13px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156); min-height: 13px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; color: rgb(77, 44, 220); background-color: rgb(254, 244, 156);"># main request routing logic</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156); min-height: 13px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);">route{</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156); min-height: 13px;"><br></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; color: rgb(188, 50, 28); background-color: rgb(254, 244, 156);"><span style="color: #c5721b"> if ($</span><span style="color: #af5f00; background-color: #e6e600">ua</span><span style="color: #c5721b">=</span><span style="color: #000000">=</span>"friendly-scanner") {</div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> sl_send_reply("200","OK")<span style="color: #4d2cdc">; </span></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> exit<span style="color: #4d2cdc">;</span></div><div style="margin: 0px; font-size: 11px; font-family: Menlo; background-color: rgb(254, 244, 156);"> }</div><div><br></div><div><div>On Nov 26, 2013, at 5:29 PM, Daniel Grotti <<a href="mailto:dgrotti@sipwise.com">dgrotti@sipwise.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi,<br>you can check the User-Agent reference $ua, if it is equal to<br>"friendly-scanner", just send back a reply with sl_send_reply("200", "OK")<br><br>Daniel<br><br><br><br>On 11/26/2013 10:53 PM, Joli Martinez wrote:<br><blockquote type="cite">How can I do this? Is there an article I can reference or something? I am new to kamailio and not sure how to do this.<br><br>Thanks,<br><br>On Nov 26, 2013, at 4:41 PM, Ovidiu Sas <<a href="mailto:osas@voipembedded.com">osas@voipembedded.com</a>> wrote:<br><br><blockquote type="cite">Google around for "friendly-scanner" to learn more about it.<br>In the mean time, allow the packets to be handled by kamailio and send<br>a 200ok back - maybe this will stop the attack.<br>After the attack is stopped, simply drop all "friendly-scanner" SIP requests :)<br><br>Regards,<br>Ovidiu Sas<br><br>On Tue, Nov 26, 2013 at 4:32 PM, Joli Martinez <<a href="mailto:mrjoli021@gmail.com">mrjoli021@gmail.com</a>> wrote:<br><blockquote type="cite">it is comming from "friendly-scanner" The other issue I have is that "/var/log/secure" is not getting the sip requests so the only way I realize it is happeing is from tcpdump. If the secure file is not picking it up then iptables wont know about it. How can I tell iptables to listen for sip requests? I have already added the IP to the blocked IP's but he still keeps on comming.<br><br>Thanks,<br><br>On Nov 26, 2013, at 4:28 PM, Ovidiu Sas <<a href="mailto:osas@voipembedded.com">osas@voipembedded.com</a>> wrote:<br><br><blockquote type="cite">Most likely it's a bogus script.<br>Sometimes just sending a dummy reply, will stop the script sending SIP requests.<br>Check the User-Agent header and from username to see if you can<br>identify the script and google around for it.<br><br>Regards,<br>Ovidiu Sas<br><br>On Tue, Nov 26, 2013 at 4:17 PM, Joli Martinez <<a href="mailto:mrjoli021@gmail.com">mrjoli021@gmail.com</a>> wrote:<br><blockquote type="cite">I am running Kamailio in CentOS. I ran tcpdump and noticed that we are getting attacked from IP 188.138.32.72. I have already blocked it on IPtables, but he keeps on attacking the server. If I look at "/var/log/secure" there are no SIP messages. My question is where is the log file for Kamailio and how can I prevent this type of attacks in the future.<br><br>Thanks,<br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br></blockquote><br><br><br>--<br>VoIP Embedded, Inc.<br><a href="http://www.voipembedded.com">http://www.voipembedded.com</a><br><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br>sr-users@lists.sip-router.org<br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br></blockquote><br><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br></blockquote><br><br><br>-- <br>VoIP Embedded, Inc.<br><a href="http://www.voipembedded.com">http://www.voipembedded.com</a><br><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br>sr-users@lists.sip-router.org<br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br></blockquote><br><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br><br></blockquote><br>_______________________________________________<br>SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list<br><a href="mailto:sr-users@lists.sip-router.org">sr-users@lists.sip-router.org</a><br>http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users<br></blockquote></div><br></div></body></html>