Possible Force Attack?

[Amphibian]

Hey team,

Maybe I don't know as much as I thought.... I keep receiving this in my asterisk log reports:

[Aug 1 12:29:48] VERBOSE[3203][C-0000002b] netsock2.c: == Using SIP VIDEO TOS bits 136
[Aug 1 12:29:48] VERBOSE[3203][C-0000002b] netsock2.c: == Using SIP VIDEO CoS mark 6
[Aug 1 12:29:48] VERBOSE[3203][C-0000002b] netsock2.c: == Using SIP RTP TOS bits 184
[Aug 1 12:29:48] VERBOSE[3203][C-0000002b] netsock2.c: == Using SIP RTP CoS mark 5

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [13011972592863739@from-sip-external:1] NoOp("SIP/173.xxx.xxx.xxx-0000002b", "Received incoming SIP connection from unknown peer to 13011972592863739") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [13011972592863739@from-sip-external:2] Set("SIP/173.xxx.xxx.xxx-0000002b", "DID=13011972592863739") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [13011972592863739@from-sip-external:3] Goto("SIP/173.xxx.xxx.xxx-0000002b", "s,1") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Goto (from-sip-external,s,1)

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/173.xxx.xxx.xxx-0000002b", "0?checklang:noanonymous") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Goto (from-sip-external,s,5)

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/173.xxx.xxx.xxx-0000002b", "TIMEOUT(absolute)=15") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] func_timeout.c: -- Channel will hangup at 2014-08-01 12:30:03.136 CDT.

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/173.xxx.xxx.xxx-0000002b", "") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: == Spawn extension (from-sip-external, s, 6) exited non-zero on 'SIP/173.xxx.xxx.xxx-0000002b'

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/173.xxx.xxx.xxx-0000002b", "") in new stack

[Aug 1 12:29:48] VERBOSE[21898][C-0000002b] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/173.xxx.xxx.xxx-0000002b'


Am I to assume this is a attempt at a brute force attack? or am I missing something? How does one go about finding out where the "unknown peer" is coming from in this statement """Received incoming SIP connection from unknown peer to 13011972592863739""""?

I'm open to being educated,

amphibian

 

[danardf]

Hi my Frog

I think you have CSF already installed, doesn't it?

 

[Amphibian]

danardf,

Yes sir I does have CFS installed. I went back and checked the records and noticed that I started geting this after I added the ports of 1000:65000 to the "UDP IN" section of CFS. That was the only way that I could get my dyndns.org to work outside my network. I took that out of "UDP IN" and the log file no more shows these entries. So I gues its back to the drawing board to figure out how to make CFS pass my dyndns.org name.

amphibian

 

[danardf]

Yes, why setting up a such range so wide?
Here, it seems a bad way. :roll: