Finding out more user/account information regarding legitimate Blacklisted IP

[neo]

Dear All,

I have been reading the threads pertaining to Blacklisted IPs but couldn't find one relating to my issue.

Almost every morning when work resumes at my office, I received an email pointing out that IP w.x.y.z has been blacklisted on PBX myownpbx.3cx.com
From IP records, I know this is one of our 100 employees. Furthermore Geo IP localisation online tool, indicates that the IP is inside my organistaion. Unfortunately, the Event Log with its ID do not provide much information to trace it out.

I have launched a wireshark capture (verbose enabled) and let it run. The problem with that method is that I need not to overfill the log partition if I forgot to stop it and it appears like a fisherman catching a fish. The idea was to parse the captured pcap traces with the command sip.CSeq.method == REGISTER to see if there is any relevant info regarding a particular account. From there on, contact the user and sort out the issues.

Is there anyone onboard who has a better idea to trace out that blacklisted user please?
Also note that I have unchecked Global Blacklist option. I have checked that IP range in Blacklist and it was now there. Besides that other users do connect on that same subnet w.x.y...

Thanks all for your help.

 

[Evolute IT]

The activity log should show the full SDP.

 

[JohnS_3CX]

@neo since you know how to run a capture, you will have already caught the attempt.

You also know the blacklisted IP so this makes things easier

filter with ip.addr==192.168.0.100 (replace IP with the right one) and see the attempts made around the time you get the blacklisting notification (enable it from Settings > Email > Notifications > An IP has been blacklisted).

Note the User Agent of whoever/whatever is trying to login (should appear in the INVITE or REGISTER message header). It should reveal a model name (and sometimes mac address) in case its just a forgotten phone that needs to be reconfigured.


User Agents can be spoofed by attackers though, so unless you found the device in question and the attempts go away, then do not trust that the issue is solved and keep looking.

 

[neo]

@Frederick Marcoux Thanks! That was going to be my first step. Today, I have launched the capture an hour before office opening and guess what? Bam! I caught one IP successfully while Wireshark running. (With working-at-home a reality now, sometimes the blacklisted IP was at night or during the week end).

@JohnS_3CX Thanks for your detailed procedure. I have indeed use the filter ip.addr==w.x.y.z and sip.CSeq.method==REGISTER to parse the pcap trace. From the timestamp of the email, I have managed to find out who it could be. No MAC address in there. So not a deskphone. Same account was sending 407 and 200 OK from Registrar - all through port 5060. I guess it is the latter's smartphone. In the first instance, I have requested the user to uninstall the Android app since he said is no longer using it. In the trace, I have also seen tunnel 5090 being used.

I will have check it tomorrow. Thank you both for helping me narrowing the search. By the way, using https://www.maxmind.com/en/geoip2-precision-demo and IP Geolocation help to find out that the user was within my office!

Hope this can help some newbie out there!

 

[JohnS_3CX]

Glad to be of help, a little bonus tip:

The capture header of each packet may reveal the MAC address that sent the packet (although sometimes it's replaced by the MAC of your router).

You can then look at your list of DHCP clients, and find out what that MAC address is via an OUI MAC search