Hello everyone, I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen this or can explain this? Chain fail2ban-ASTERISK (1 references) num target prot opt source destination 1 DROP all -- 0.23.20.189 0.0.0.0/0 I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when I am testing. Are these numbers taken from the SIP packet or the TCP/IP protocol source because they surely are not valid addresses. Thanks -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20120126/2627824f/attachment.htm>
asterisk jobs ????? 27.01.2012 06:49:> Hello everyone, Ihave noticed getting wired IPs blocked by Fail2ban. Has anyone else seen this or can explain this?> > Chain fail2ban-ASTERISK (1 references)> num target prot opt source destination > 1 DROP all -- 0.23.20.1890.0.0.0/0 [1]> I also get things like, 0.0.5.2, etc....Fail2ban seemsto be working when I am testing. Are these numbers taken from the SIP packet or the TCP/IP protocol source because they surely are not valid addresses.> ThanksDid you find those IPs in Asterisk log? If so - it isn't Fail2Ban problem, for it just parses logs and extracts substring -- With Best Regards Mikhail Lischuk Links: ------ [1] http://0.0.0.0/0 -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20120127/97f6a4b0/attachment.htm>
On Thu, Jan 26, 2012 at 11:49:32PM -0500, asterisk jobs wrote:> Hello everyone, > > I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen > this or can explain this? > > Chain fail2ban-ASTERISK (1 references) > num target prot opt source destination > 1 DROP all -- 0.23.20.189 0.0.0.0/0 > > I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when I > am testing. Are these numbers taken from the SIP packet or the TCP/IP > protocol source because they surely are not valid addresses. > > ThanksSee fail2ban-regex(1). It's very useful for discovering what fail2ban makes of your log files. -- Barry
On 27 January 2012 04:49, asterisk jobs <asteriskcoding at gmail.com> wrote:> Hello everyone, > > I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen > this or can explain this? > > Chain fail2ban-ASTERISK (1 references) > num target prot opt source destination > 1 DROP all -- 0.23.20.189 0.0.0.0/0 > > I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when > I am testing. Are these numbers taken from the SIP packet or the TCP/IP > protocol source because they surely are not valid addresses. > > Thanks > > -- > _______________189.20.23.0 ?> ______________________________________________________ > -- Bandwidth and Colocation Provided by http://www.api-digital.com -- > New to Asterisk? Join us for a live introductory webinar every Thurs: > http://www.asterisk.org/hello > > asterisk-users mailing list > To UNSUBSCRIBE or update options visit: > http://lists.digium.com/mailman/listinfo/asterisk-users >-------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20120210/6bfd1fae/attachment.htm>
That was just another weird IP showing up. On Fri, Feb 10, 2012 at 4:50 PM, dotnetdub <dotnetdub at gmail.com> wrote:> > > On 27 January 2012 04:49, asterisk jobs <asteriskcoding at gmail.com> wrote: > >> Hello everyone, >> >> I have noticed getting wired IPs blocked by Fail2ban. Has anyone else >> seen this or can explain this? >> >> Chain fail2ban-ASTERISK (1 references) >> num target prot opt source destination >> 1 DROP all -- 0.23.20.189 0.0.0.0/0 >> >> I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when >> I am testing. Are these numbers taken from the SIP packet or the TCP/IP >> protocol source because they surely are not valid addresses. >> >> Thanks >> >> -- >> _______________ > > > > > > > 189.20.23.0 ? > > > >> ______________________________________________________ >> -- Bandwidth and Colocation Provided by http://www.api-digital.com -- >> New to Asterisk? Join us for a live introductory webinar every Thurs: >> http://www.asterisk.org/hello >> >> asterisk-users mailing list >> To UNSUBSCRIBE or update options visit: >> http://lists.digium.com/mailman/listinfo/asterisk-users >> > > > -- > _____________________________________________________________________ > -- Bandwidth and Colocation Provided by http://www.api-digital.com -- > New to Asterisk? Join us for a live introductory webinar every Thurs: > http://www.asterisk.org/hello > > asterisk-users mailing list > To UNSUBSCRIBE or update options visit: > http://lists.digium.com/mailman/listinfo/asterisk-users >-------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-users/attachments/20120210/a2fa8a26/attachment.htm>
On 12-01-26 11:49 PM, asterisk jobs wrote:> Hello everyone, > > I have noticed getting wired IPs blocked by Fail2ban. Has anyone else seen > this or can explain this? > > Chain fail2ban-ASTERISK (1 references) > num target prot opt source destination > 1 DROP all -- 0.23.20.189 0.0.0.0/0 > > I also get things like, 0.0.5.2, etc....Fail2ban seems to be working when I > am testing. Are these numbers taken from the SIP packet or the TCP/IP > protocol source because they surely are not valid addresses. >What version of asterisk 1.8 are you using? I suspect this is a bug we recently fixed in 1.8.8.0+ -- Paul Belanger Digium, Inc. | Software Developer twitter: pabelanger | IRC: pabelanger (Freenode) Check us out at: http://digium.com & http://asterisk.org