Log error message on unsuccessful REGISTER and let fail2ban do the rest. Anyway you're running fail2ban, don't you?
On Sunday 19 June 2016 21:19:42 Яцко Эллад Геннадьевич wrote: > Hello! > > How to detect several unsuccessful REGISTER attempts from the same IP? > > For example: a malicious user tries to look for passwords, can I detect > this in some way to black list it? As you know there are different SIP > dialogs here.. I need to mention these attempts should be counted > during certain period of time (e. g. 1 minute). If there were ONLY TWO > attempts for 1 minute the counter need to be reset to zero. > > I've read about PERMISSIONS/BLST, but they don't offer such a mechanism. > > I'll be waiting for your help, guys! :-) > > Kind regards, > Ellad > > _______________________________________________ > SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list > sr-users@lists.sip-router.org > http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users _______________________________________________ SIP Express Router (SER) and Kamailio (OpenSER) - sr-users mailing list sr-users@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-users