thr3ads.net - asterisk users - [asterisk-users] SIP client floods port 5060 and gets blocked [Oct 2010]

If this information is useful, please help other people find it:
Share via:

Jonas Kellens

2010-Oct-28 07:38 UTC

[asterisk-users] SIP client floods port 5060 and gets blocked

Hello,

Is there any reason why an IP-phone would pounder on port 5060 ? My 
firewall blocks the public IP because it thinks the remote IP is port 
scanning on port 5060.

I think the phone is just registering but for some reason it does this 
repeatedly in a very short time.


Oct 28 09:01:48 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48073 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:01:49 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48074 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:01:50 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48075 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:01:52 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48076 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:01:56 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48077 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:00 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48078 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:04 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48079 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:08 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48083 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:12 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48084 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:16 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48085 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676
Oct 28 09:02:20 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 
OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip 
DST=server_ip LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48087 DF PROTO=UDP 
SPT=2367 DPT=5060 LEN=676


Any input on this ?!


Kind regards,
Jonas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20101028/88d517e4/attachment-0001.htm

Kevin Keane

2010-Oct-28 08:44 UTC

head link

[asterisk-users] SIP client floods port 5060 and gets blocked

I assume that you checked and the remote IP is a legitimate IP phone? If not, it
could be an attempt to break into your system.

If it is a legitimate IP phone, make sure that the SIP configuration is correct
- if the SIP authentication fails, you can see this happening.

From: asterisk-users-bounces at lists.digium.com [mailto:asterisk-users-bounces
at lists.digium.com] On Behalf Of Jonas Kellens
Sent: Thursday, October 28, 2010 12:39 AM
To: Asterisk Users Mailing List - Non-Commercial Discussion
Subject: [asterisk-users] SIP client floods port 5060 and gets blocked

Hello,

Is there any reason why an IP-phone would pounder on port 5060 ? My firewall
blocks the public IP because it thinks the remote IP is port scanning on port
5060.

I think the phone is just registering but for some reason it does this
repeatedly in a very short time.


Oct 28 09:01:48 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48073 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:01:49 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48074 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:01:50 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48075 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:01:52 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48076 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:01:56 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48077 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:00 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48078 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:04 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48079 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:08 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48083 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:12 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48084 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:16 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48085 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676
Oct 28 09:02:20 astserver kernel: Firewall: *UDP_IN Blocked* IN=eth0 OUT=
MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=remote_ip DST=server_ip
LEN=696 TOS=0x00 PREC=0x00 TTL=53 ID=48087 DF PROTO=UDP SPT=2367 DPT=5060
LEN=676


Any input on this ?!


Kind regards,
Jonas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20101028/3823c3be/attachment.htm

Jonas Kellens

2010-Oct-28 09:03 UTC

head link

[asterisk-users] SIP client floods port 5060 and gets blocked

On 10/28/2010 10:44 AM, Kevin Keane wrote:>
> I assume that you checked and the remote IP is a legitimate IP phone? 
> If not, it could be an attempt to break into your system.
>
> If it is a legitimate IP phone, make sure that the SIP configuration 
> is correct -- if the SIP authentication fails, you can see this happening.
>
1. This is a legitimate phone, yes.
2. Registration goes as follow : REGISTER > SIP/2.0 401 Unauthorized > 
Re-Register with Digest > 200 OK


Regards,
Jonas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20101028/a9a8f49b/attachment.htm

Jonas Kellens

2010-Oct-29 12:00 UTC

head link

[asterisk-users] SIP client floods port 5060 and gets blocked

Hello,

any more input on this subject ?!


Kind regards,
Jonas.


-------- Original Message --------
Subject: 	Re: [asterisk-users] SIP client floods port 5060 and gets blocked
Date: 	Thu, 28 Oct 2010 13:42:12 +0200
From: 	Jonas Kellens <jonas.kellens at telenet.be>
To: 	Asterisk Users Mailing List - Non-Commercial Discussion 
<asterisk-users at lists.digium.com>



On 10/28/2010 12:52 PM, Gordon Henderson wrote:>  On Thu, 28 Oct 2010, Jonas Kellens wrote
>>  On 10/28/2010 10:44 AM, Kevin Keane wrote:
>>
>>>  I assume that you checked and the remote IP is a legitimate IP
phone? If
>>>  not, it could be an attempt to break into your system.
>>>
>>>  If it is a legitimate IP phone, make sure that the SIP
configuration is
>>>  correct -- if the SIP authentication fails, you can see this
happening.
>>>
>>>
>>  1. This is a legitimate phone, yes.
>>  2. Registration goes as follow : REGISTER>   SIP/2.0 401
Unauthorized>
>>  Re-Register with Digest>   200 OK
>>
>  Is it s Snom phone?
>
>  I've seen Snoms do this...
>
>  Gordon
>
I have this with Snom 320, Snom 370, Grandstream GXW4008 and YeaLink T28...


Jonas.

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://lists.digium.com/pipermail/asterisk-users/attachments/20101029/2bf8b049/attachment.htm

Apparently Analagous Threads

Search for more reasonably related threads

asterisk users - Oct 2010 - SIP client floods port 5060 and gets blocked

[asterisk-users] SIP client floods port 5060 and gets blocked

[asterisk-users] SIP client floods port 5060 and gets blocked

[asterisk-users] SIP client floods port 5060 and gets blocked

[asterisk-users] SIP client floods port 5060 and gets blocked

Apparently Analagous Threads