Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Tzafrir Cohen
On Sat, Oct 30, 2010 at 07:33:23PM -0600, Joel Maslak wrote: The CPU usage is trivial to deny them. As is the bandwidth usage, if you are not sitting on a slowish broadband connection. s/slow/assymetric/ Sure blocking doesn't hurt, but does the help it provides exceed the downsides

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread dotnetdub
On 30 October 2010 19:28, Zeeshan Zakaria zisha...@gmail.com wrote: My main asterisk server is under unusual heavy attack, and so far Fail2Ban has blocked about 30 IPs, from various different countries. At this time it is blocking about 1 IP address every few minutes. Just wondering if

Re: [asterisk-users] Exceptionally long queue length queuing . . . .

2010-10-31 Thread Vieri
I have the same problem, once in a while. Curiously though, it occurs on a dedicated 100Mbps switched local network. I'm running 1.4.31 * servers. Vieri --- On Sat, 10/30/10, Brian Capouch bri...@palaver.net wrote: I wonder if anyone out there has a perspective on this.  There are a

Re: [asterisk-users] Exceptionally long queue length queuing . . . .

2010-10-31 Thread Paul Belanger
On Sat, Oct 30, 2010 at 6:22 PM, Brian Capouch bri...@palaver.net wrote: I wonder if anyone out there has a perspective on this.  There are a welter of tickets out there on the matter, most of them closed. I'm actually able to reproduce this pretty often, for me using IAX2 with IMAP voicemail

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Gordon Henderson
On Sun, 31 Oct 2010, Tzafrir Cohen wrote: On Sat, Oct 30, 2010 at 01:43:49PM -0600, Joel Maslak wrote: Is there really any benefit to blocking these, if you use good passwords? Regardless of any threat from those attacks succeeding, they completely saturated the uplink in our ADSL-connected

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Joel Maslak
On Sun, Oct 31, 2010 at 2:40 AM, Tzafrir Cohen tzafrir.co...@xorcom.comwrote: On Sat, Oct 30, 2010 at 07:33:23PM -0600, Joel Maslak wrote: The CPU usage is trivial to deny them. As is the bandwidth usage, if you are not sitting on a slowish broadband connection. s/slow/assymetric/ A

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread jon pounder
I already have a monitor (tied into nagios, which pages me if my fraud thresholds are exceeded), but I feel that is probably beyond the abilities of most of the people experiencing call fraud. The people who know what they are doing with Unix and Asterisk are generally not the victims

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Mark Deneen
On Sun, Oct 31, 2010 at 11:26 AM, Joel Maslak jmas...@antelope.net wrote: If these are mobile users, I hope they never use any public networks (hotels, starbucks) where other subscribers can do things like ARP attacks to do MITM (and steal your calls; it might not be happening today, but it

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Jeff LaCoursiere
On Sat, 30 Oct 2010, Joel Maslak wrote: For me, monitoring outbound call volume makes a lot more sense. I would love to see an easy to use, out of the box method to alert me if more than x number of erlangs* are exceeded within a five minute, sixty minute, and one day time period. For

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread jon pounder
On 10/31/2010 11:39 AM, Mark Deneen wrote: On Sun, Oct 31, 2010 at 11:26 AM, Joel Maslakjmas...@antelope.net wrote: If these are mobile users, I hope they never use any public networks (hotels, starbucks) where other subscribers can do things like ARP attacks to do MITM (and steal your

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Joel Maslak
On Oct 31, 2010, at 9:57 AM, Jeff LaCoursiere j...@sunfone.com wrote: This only tells you after it is way too late that you now have upstream bills to wrangle with your carriers about, or (like in my case) that your balance is now depeleted, if it trips anything at all. In my very recent

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Joel Maslak
On Oct 31, 2010, at 9:39 AM, Mark Deneen mden...@gmail.com wrote: On Sun, Oct 31, 2010 at 11:26 AM, Joel Maslak jmas...@antelope.net wrote: If these are mobile users, I hope they never use any public networks (hotels, starbucks) where other subscribers can do things like ARP attacks to do

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread C F
Like I said before RUBBISH. One should just ban/block IPs that are attacking you and not let them connect at all. Not just protect against them with fancy passwords. BTW, even your fancy passwords are breakable, can't wait for the day that you'll wake up and smell the coffee. On Sun, Oct 31, 2010

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Joel Maslak
On Oct 31, 2010, at 9:40 AM, jon pounder j...@inline.net wrote: what are you using that is tied to nagios ? I'll package it up next week and make it available. Basically, I use nrpe to call a shell script that looks at the last five minutes, 60 minutes, and 1440 minutes of a asterisk -rx

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread C F
On Sun, Oct 31, 2010 at 12:45 PM, Joel Maslak jmas...@antelope.net wrote: On Oct 31, 2010, at 9:57 AM, Jeff LaCoursiere j...@sunfone.com wrote: This only tells you after it is way too late that you now have upstream bills to wrangle with your carriers about, or (like in my case) that your

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Joel Maslak
To guess an 8 character (which is short) password that consists of random upper case, lower case, numbers, and 10 symbols (there are more you can use if you want), the average number of passwords that you would have to try to get in is: (72^8) / 2 = 361,102,068,154,368 guesses Over a 10 mb/s

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread C F
On Sun, Oct 31, 2010 at 1:39 PM, Joel Maslak jmas...@antelope.net wrote: To guess an 8 character (which is short) password that consists of random upper case, lower case, numbers, and 10 symbols (there are more you can use if you want), the average number of passwords that you would have to

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread jon pounder
On 10/31/2010 12:58 PM, Joel Maslak wrote: On Oct 31, 2010, at 9:40 AM, jon pounderj...@inline.net wrote: what are you using that is tied to nagios ? I'll package it up next week and make it available. Basically, I use nrpe to call a shell script that looks at the last five

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Niles Ingalls
On Oct 30, 2010, at 2:28 PM, Zeeshan Zakaria wrote: My main asterisk server is under unusual heavy attack, and so far Fail2Ban has blocked about 30 IPs, from various different countries. At this time it is blocking about 1 IP address every few minutes. Just wondering if anybody else is

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Steve Totaro
On Sun, Oct 31, 2010 at 3:45 PM, Niles Ingalls ni...@atheos.net wrote: On Oct 30, 2010, at 2:28 PM, Zeeshan Zakaria wrote: My main asterisk server is under unusual heavy attack, and so far Fail2Ban has blocked about 30 IPs, from various different countries. At this time it is blocking

Re: [asterisk-users] Under heavy attack

2010-10-31 Thread Steve Totaro
On Sun, Oct 31, 2010 at 3:45 PM, Niles Ingalls ni...@atheos.net wrote: On Oct 30, 2010, at 2:28 PM, Zeeshan Zakaria wrote: My main asterisk server is under unusual heavy attack, and so far Fail2Ban has blocked about 30 IPs, from various different countries. At this time it is blocking

[asterisk-users] billsec=0 when using Local channel

2010-10-31 Thread Dan Journo
Hi, I've got a dialplan that transfers all outgoing calls to a Local channel before dialling out via SIP. I did this because sometimes i'm dialling two numbers at the same time and need to know which call is answered for billing purposes. However, I've just noticed that billsec is always equal

Re: [asterisk-users] billsec=0 when using Local channel

2010-10-31 Thread Dan Journo
Hi, I've got a dialplan that transfers all outgoing calls to a Local channel before dialling out via SIP. I did this because sometimes i'm dialling two numbers at the same time and need to know which call is answered for billing purposes. However, I've just noticed that billsec is always equal

[asterisk-users] Music On Hold Help

2010-10-31 Thread Matt Darnell
We have a customer that does not care for the default MoH. We have downloaded some royalty free music but it sounds 'fuzzy' when we test it with the system. We down sample it to 16bit, 8KHz, Mono. We have tried with Audacity, CoolEdit Pro, VLC. Does someone have a file they can send me that

Re: [asterisk-users] Music On Hold Help

2010-10-31 Thread Steve Edwards
On Sun, 31 Oct 2010, Matt Darnell wrote: We have downloaded some royalty free music but it sounds 'fuzzy' when we test it with the system. Can you post a link to the original? -- Thanks in advance, - Steve Edwards

Re: [asterisk-users] Music On Hold Help

2010-10-31 Thread Matt Darnell
On Sun, Oct 31, 2010 at 5:34 PM, Steve Edwards asterisk@sedwards.comwrote: On Sun, 31 Oct 2010, Matt Darnell wrote: We have downloaded some royalty free music but it sounds 'fuzzy' when we test it with the system. Can you post a link to the original? Here is the original -