Friendly-Scanner

Discussion in '3CX Phone System - General' started by Wanderer, Nov 14, 2010.

Thread Status:
Not open for further replies.
  1. Wanderer

    Joined:
    Nov 9, 2010
    Messages:
    19
    Likes Received:
    0
    Hi
    I am experiencing an on going problem at the moment, our system keeps getting attacked by various using "friendly-scanner", although they are not getting access they are maxing my adsl bandwidth to 100%. I no sooner get rid of one then another starts.

    REGISTER sip:10.25.50.6 SIP/2.0
    Via: SIP/2.0/UDP 67.222.24.40:5114;branch=z9hG4bK-3613954783;rport=5114
    Max-Forwards: 70
    Contact: <sip:123@1.1.1.1>
    To: "015" <sip:015@10.25.50.6>
    From: "015" <sip:015@10.25.50.6>
    Call-ID: 3284308801
    CSeq: 1 REGISTER
    Accept: application/sdp
    User-Agent: friendly-scanner
    Content-Length: 0

    If anybody has any ideas I would be grateful.

    Tim
     
  2. SY

    SY Well-Known Member
    3CX Support

    Joined:
    Jan 26, 2007
    Messages:
    1,825
    Likes Received:
    2
    You need to ask your ISP to block this traffic because even if you block it on your router/firewall it will still consume bandwidth of ADSL connection.

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  3. Wanderer

    Joined:
    Nov 9, 2010
    Messages:
    19
    Likes Received:
    0
    Hi Stepan

    Sorry to say, been there done that, and been told there is nothing they can do.

    Tim
     
  4. SY

    SY Well-Known Member
    3CX Support

    Joined:
    Jan 26, 2007
    Messages:
    1,825
    Likes Received:
    2
    Hi Tim,

    In this case I can suggest to restrict traffic on your NAT/firewall to allow only trusted networks (locations of the remote extensions/VoIP providers) to communicate with PBX.

    Thanks
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  5. sigma1

    sigma1 Active Member

    Joined:
    Nov 20, 2009
    Messages:
    542
    Likes Received:
    1
    Not knowing what router you have, you could set your firewall to DROP these packets (meaning no reply) to save some bandwidth and appear stealth. eventually that may stop.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. Wanderer

    Joined:
    Nov 9, 2010
    Messages:
    19
    Likes Received:
    0
    Hi
    Deployed firewalls and all okay now.

    Thanks all
     
Thread Status:
Not open for further replies.