24 Nov
2006
24 Nov
'06
4:57 a.m.
Hello,
On 11/22/06 17:57, Kelvin Williams wrote:
Yesterday, something happened—the exact I do not know just yet.
However, when looking at the logging that I have my OpenSER performing
I seen a ton of INVITES, CANCELs, OpenSER became unusable for a time
until I was able to block all SIP traffic at the firewall and let it
calm down enough to restart it.
During this process calls could not be made (in or out). Is there a
way to prevent this type of behavior? It looked as though there were
only a handful of calls that caused a continuous loop.
that means that something is wrong with the configuration file or the
sip request. The message was not properly handled and looped. If there
is no need for loops in your config, you can have a check at the
beginning of the script denying requests from local IP. If you need
loops, then try to lower maxfwd value so it will loop less. However, the
best is to detect which was the problem and fix it, and have the above
fixes to prevent similar cases in future.
If you faced a flood attack, the best is to look at pike module.
Cheers,
Daniel
What logic is recommended to test for a call that has
been handled too
many times by the proxy, and to immediately drop it?
Thanks in advance.
------------------------------------------------------------------------
_______________________________________________
Users mailing list
Users(a)openser.org
http://openser.org/cgi-bin/mailman/listinfo/users