1

I'm still new to Asterisk/Elastix and apologize if this question is misplaced.

Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have stopped the hackers from trying to register extensions but I still suspect that the server is under some sort of attack.

There is a constant stream of WARNINGs in the Asterisk CLI stating something along the lines of:

WARNING[2184]: chan_sip.c:3755 __sip_xmit: sip_xmit of ... (len 371) to (null) returned -1: Invalid argument

There are about 3 to 5 of these warnings each second and I am concerned that it will affect quality of service or lead the company to be victims of fraudsters.

Could the warnings be the result of an improperly configured PBX or could it be a possible attack?

The clients current setup is as follows:

  • Elastix 4.0.74
  • Asterisk 11.20.0

See screenshot of warning messages in CLI below: enter image description here Thanks in advance.

  • Possible duplicate of How to deal with compromised server? – grochmal Jan 2 '17 at 21:26
  • 1
    @grochmal Not at all a duplicate of that. It's a question about whether these log alerts could point to a malicious attack. – Polynomial Jan 2 '17 at 22:58
  • I'm not sure whether to suspect that the attackers merely changed their MO after I blocked them from attempting to register extensions with fail2ban, or if I screwed a config setting somewhere by doing so. Either way they threat level remains unknown to me – Son of Sam Jan 25 '17 at 10:19
  • This is rather old, but in general if you suspect a network attack, run a packet capture and look for unusual traffic. – Steve Sether Aug 1 '17 at 21:14
0

It appears that the system is doing a DNS lookup of the Trunk name possibly.

  • Is there any way to identify which trunks they are trying to look up or to figure out from which IP it is being done? – Son of Sam Jan 25 '17 at 10:22
  • you could try turning on sip debug. sip set debug on from the asterisk cli. – deadlisting Jan 25 '17 at 15:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.