Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-15 Thread Mike Wright
Patrick Lists wrote: On 10/15/2010 12:56 AM, Rick Sewill wrote: [snip] Would you mind sharing which networks your attacks came from? I hesitate to answer, but will. The people who own 67.222.1.124 and 184.106.213.202 were very cooperative and interested. The Chinese IP address was

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-15 Thread Sam Sharpe
On 15 October 2010 02:31, JD jd1...@gmail.com wrote: Try to use www.arin.net You will see that arin.net will not tell you to which network (such as APNIC ) it belongs. Very mysterious :) s...@samlap:~$ whois 218.14.146.200 % [whois.apnic.net node-2] % Whois data copyright terms

[OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Rick Sewill
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is off topic, but I thought I should tell people. This past weekend, I suffered a DOS attack launched against VOIP SIP Clients. The attack came, at different times, from 3 separate IP addresses. I blocked the IP addresses using IP Tables when

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Patrick Lists
On 10/14/2010 09:29 PM, Rick Sewill wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is off topic, but I thought I should tell people. This past weekend, I suffered a DOS attack launched against VOIP SIP Clients. The attack came, at different times, from 3 separate IP addresses.

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread James Mckenzie
Rick Sewill rsew...@gmail.com wrote: This is off topic, but I thought I should tell people. Can these clients be run on Fedora? Also this attack may target more than just VOIP SIP clients. Thank you for the warning. James McKenzie -- users mailing list users@lists.fedoraproject.org To

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Patrick Lists
On 10/14/2010 10:03 PM, James Mckenzie wrote: Rick Sewillrsew...@gmail.com wrote: This is off topic, but I thought I should tell people. Can these clients be run on Fedora? Well twinkle is available on F13: $ yum info twinkle Loaded plugins: presto, refresh-packagekit Available Packages

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Wolfgang S. Rupprecht
Rick Sewill rsew...@gmail.com writes: This past weekend, I suffered a DOS attack launched against VOIP SIP Clients. The attack came, at different times, from 3 separate IP addresses. I'm seeing a vast increase in attemted SIP registers too. Asterisk (f13 more or less stock via yum) seems to

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Rick Sewill
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 10/14/2010 02:58 PM, Patrick Lists wrote: On 10/14/2010 09:29 PM, Rick Sewill wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is off topic, but I thought I should tell people. This past weekend, I suffered a DOS attack launched

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread JD
On 10/14/2010 03:56 PM, Rick Sewill wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On 10/14/2010 02:58 PM, Patrick Lists wrote: On 10/14/2010 09:29 PM, Rick Sewill wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 This is off topic, but I thought I should tell people. This

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread Patrick Lists
On 10/15/2010 12:56 AM, Rick Sewill wrote: [snip] Would you mind sharing which networks your attacks came from? I hesitate to answer, but will. The people who own 67.222.1.124 and 184.106.213.202 were very cooperative and interested. The Chinese IP address was 218.14.146.200. I could

Re: [OT] To people with VoIP SIP Clients (twinkle, etc), friendly-scanner DOS attack

2010-10-14 Thread JD
On 10/14/2010 06:21 PM, Patrick Lists wrote: On 10/15/2010 12:56 AM, Rick Sewill wrote: [snip] Would you mind sharing which networks your attacks came from? I hesitate to answer, but will. The people who own 67.222.1.124 and 184.106.213.202 were very cooperative and interested. The