nanog mailing list archives

Re: Scam telemarketers spoofing our NOC phone number for callerid


From: William Herrin <bill () herrin us>
Date: Wed, 6 Oct 2010 11:15:25 -0400

On Wed, Oct 6, 2010 at 10:37 AM, Dan White <dwhite () olp net> wrote:
If your PBX is SIP based, you might be victim of a SIP registration hijack,
which are on the rise, based on traffic we've been seeing in our network.

I had my unpublished asterisk box up for all of two days before
getting half a megabit per second worth of false SIP registration
attempts. Filled /var/log. I had to write a script to dynamically
filter source IPs with too many failures.

Regards,
Bill Herrin

-- 
William D. Herrin ................ herrin () dirtside comĀ  bill () herrin us
3005 Crane Dr. ...................... Web: <http://bill.herrin.us/>
Falls Church, VA 22042-3004


Current thread: