On Sun, 30 Oct 2011 17:01:39 -0400, Tony Graziano wrote: > This is an INVITE sent to port 5060 trying to run a script against your sip > server. At first glance it could have been a process list, but it is a CDR > log. Your description leaves a lot to be desired.
My description is all I have at the moment which is why I posted. Always happy to post more if I need to. As you can see, I've checked all of the first things I could think of upon finding out. >This has been discussed many times. The first line of defense is AT THE >FIREWALL. Yes, I've seen these discussions and keep my eye on them when I see anything about security. I recall max connections being mentioned but I don't recall anyone suggesting what it should be. Either way, this doesn't seem to answer why the logs look as they do? > Ex: pfsense, Firewall, RULES, 5060, edit, Advanced Options. > > Maximum new connections / per second(s) > > You can also block specific countries using the country block package. > Unsure where these are coming from? Dig into the logs, or look at the state > tables in the firewall. I do have certain countries blocked but I never bothered with the max connections until now. _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users/
