Folgende Probleme habe ich mit meiner MobyDick (7.11.02)
In der Kanalanzeige sehe ich, dass meine MobyDick ständig System call’s auf verschiedene Nummer tätigt. Letzte nach wurden sogar die Notrufnummern gewählt! Die Anrufe sind aber im Rufjournal nicht ersichtlich.
Seit einigen Tagen erhalte ich zur gleichen Zeit (morgens um 3) die Meldung um ±4:30 kommt die Meldung Dienst OK
hast du deine MobyDick frei im Internet hängen? Wäre das erste was mir hierzu einfällt, nicht dass jemand versucht hier kostenpflichtige Anrufe abzusetzen.
Hardware ist (war) hinter einem Firewall und relativ restriktiv eingestellt. Was mich irritiert, ist das es keine Aufzeichnungen ins Rufjournal geschrieben werden.
Könnte sich ein Virus eingeschlichen haben?
du könntest mal in das asterisk messages.log schauen, ob du hier passende Einträge findest. So könnte man den peer bzw. die IP ausfindig machen. Dann wüsste man wo der Anruf herkommt.
Auszug aus dem Log. Angriff sollte nun mit Firewall-Port-Restriction unterbunden sein. Ein Accept habe ich aber in dem Log bis jetzt noch nicht gefunden und dennoch wurden Anrufe gestartet. EIne Idee wieso?
Danke und Grüsse
Fabian
[Feb 15 03:09:10] NOTICE[1504] chan_sip.c: Registration from ‘“307” <sip:307@10.0.0.17:5060>’ failed for ‘212.83.153.150:5075’ - Wrong password
[Feb 15 03:09:13] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 462238076cf3b36fd6a8f02214da73fd for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:25] NOTICE[1504] chan_sip.c: Registration from ‘“207” <sip:207@10.0.0.17:5060>’ failed for ‘212.83.153.150:5118’ - Wrong password
[Feb 15 03:09:36] NOTICE[1504] chan_sip.c: Peer ‘41Nummer’ is now UNREACHABLE! Last qualify: 10
[Feb 15 03:09:36] NOTICE[1504] chan_sip.c: Peer ‘mdc_trunk_conf-1’ is now Lagged. (3516ms / 2000ms)
[Feb 15 03:09:36] NOTICE[1504] chan_sip.c: Peer ‘41Nummer’ is now Lagged. (3517ms / 2000ms)
[Feb 15 03:09:40] NOTICE[1504] chan_sip.c: Peer ‘mdc_trunk_conf-7’ is now UNREACHABLE! Last qualify: 16
[Feb 15 03:09:41] NOTICE[1504] chan_sip.c: Peer ‘mdc_trunk_conf-2’ is now UNREACHABLE! Last qualify: 11
[Feb 15 03:09:46] NOTICE[1504] chan_sip.c: Peer ‘41Nummer’ is now Reachable. (57ms / 2000ms)
[Feb 15 03:09:46] NOTICE[1504] chan_sip.c: Peer ‘mdc_trunk_conf-1’ is now Reachable. (57ms / 2000ms)
[Feb 15 03:09:46] NOTICE[1504] chan_sip.c: Peer ‘41Nummer’ is now Reachable. (58ms / 2000ms)
[Feb 15 03:09:50] NOTICE[1504] chan_sip.c: Peer ‘mdc_trunk_conf-7’ is now Reachable. (25ms / 2000ms)
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 2203463661 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 3133890775 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 31999ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 2611825560 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 31999ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 1319749291 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 220506766 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 1204707145 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 2311174618 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 3144350146 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 4868084 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 1152606604 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 1889940336 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 3795384061 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 3290849208 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 3880219948 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 2745771028 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Hanging up call 2745771028 - no reply to our critical packet (see https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions).
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 785337052 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[Feb 15 03:09:50] WARNING[1504] chan_sip.c: Retransmission timeout reached on transmission 1269364843 for seqno 1 (Critical Response) – See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
gehören, denn die Durchwahlen/Accounts 207, 307 jemand, bzw. wer hat die IP 10.0.0.17 inne?
Ansonsten lass doch mal auf der MobyDick einen TCP Trace in eine Datei mit laufen. Bitte gut einschränken soweit es geht, damit die Datei nicht zu groß wird.
Der DW 207 ist kein Arbeitsplatz und keine Person zugeteilt. Die anderen Nummern existieren nicht. Die IP gehört der MobyDick. Die Registration from hat ganz viele verschiedene Varianten, dies war nur ein kleiner Auszug.