0

I am using this command to debug my SIP traffic tcpdump -i eth0 -nt port 5060 -v

and that outputs something like this:

IP (tos 0x0, ttl 113, id 6082, offset 0, flags [none], proto UDP (17), length 504)
    128.90.192.88.56177 > 172.31.78.225.5060: SIP, length: 476
        REGISTER sip:54.84.215.2:5060 SIP/2.0
        To: <sip:[email protected]>
        From: <sip:[email protected]>;tag=e5f4a9461830e4f7a15059
        Via: SIP/2.0/UDP 10.2.38.49:56177;branch=A3DG5FK-d91443-95107561815059-1--d91443-;rport
        Call-ID: e5f4a946183180e4f7a15059
        CSeq: 1 REGISTER
        Contact: <sip:[email protected]:56177>
        Expires: 3600
        Max-Forwards: 70
        Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
        User-Agent: Samsung OfficeServ
        Content-Length: 0

IP (tos 0x0, ttl 105, id 28245, offset 0, flags [none], proto UDP (17), length 500)
    128.90.59.90.49529 > 172.31.78.225.5060: SIP, length: 472
        REGISTER sip:54.84.215.2:5060 SIP/2.0
        To: <sip:[email protected]>
        From: <sip:[email protected]>;tag=e5f4a933383e4f7a13062
        Via: SIP/2.0/UDP 10.4.0.14:49529;branch=A3DG5FK-d91443-17576214913062-1--d91443-;rport
        Call-ID: e5f4a93338364e4f7a13062
        CSeq: 1 REGISTER
        Contact: <sip:[email protected]:49529>
        Expires: 3600
        Max-Forwards: 70
        Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, NOTIFY, MESSAGE, SUBSCRIBE, INFO
        User-Agent: Samsung OfficeServ
        Content-Length: 0

... etc...

Because my server has been running for a long time, a lot of bots have found it and are being annoying sending invalid requests like the ones shown above.

I have already blocked IPs 128.90.192.88 and 128.90.59.90 and tcpdump is still capturing that traffic.

root@ip-172-31-78-225:~# iptables -nL | grep 128.90.192.88
DROP       all  --  128.90.192.88        0.0.0.0/0

How can I filter out those packets? I have over 1000 IPs blocked on my firewall (iptables) and I do not want to build a filter with that many IPs. I know I can create a white list but I am just curios to see if there is a way to filter out those packets and understand why are they are being captured. Moreover, I will like to keep using that approach to keep blocking bots that send invalid requests. It will be very nice if I could only analyze the packets that are not blocked in order to decide if I block that IP or not.

1 Answer 1

0

Sorry maybe this question is a duplicate of this other question: https://stackoverflow.com/a/57073203/637142

Anyways the solution is therefore:


#NFLOG traffic going to port 5060 (both tcp and udp)
iptables -A INPUT -p udp --dport 5060 -j NFLOG
iptables -A INPUT -p tcp --dport 5060 -j NFLOG

# now capure any trific from NFLOG
tcpdump -i nflog -nUlNt -v

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .