Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I run an SIP server which listens on UDP port 5060, and needs to accept authenticated requests from the public Internet.

The problem is that occasionally it gets picked up by people scanning for SIP servers to exploit, who then sit there all day trying to brute force the server. I use credentials that are long enough that this attack will never feasibly work, but it is annoying because it uses up a lot of bandwidth.

I have tried setting up fail2ban to read the Asterisk log and ban IPs that do this with iptables, which stops Asterisk from seeing the incoming SIP REGISTER attempts after 10 failed attempts (which happens in well under a second at the rate of attacks I'm seeing). However, SipVicious derived scripts do not immediately stop sending after getting an ICMP Destination Host Unreachable - they keep hammering the connection with packets. The time until they stop is configurable, but unfortunately it seems that the attackers doing these types of brute force attacks generally set the timeout to be very high (attacks continue at a high rate for hours after fail2ban has stopped them from getting any SIP response back once they have seen initial confirmation of an SIP server).

Is there a way to make it stop sending packets at my connection?

share|improve this question
add comment

4 Answers

The publicly available SipVicious script that many of these attackers use stops the attack instantly if it receives an invalid SIP response with no From: line. You can identify SipVicious because it sets its User-Agent in the SIP requests to friendly-scanner.

Using this technique against a real-world attacker, I have been able to immediately stop the flood of packets. You can send such a packet with a simple script. For example:

cat >UnfriendlyScannerStopper.scala <<END
import java.net._

object UnfriendlyScannerStopper {
  def main(args : Array[String]) : Unit = {
    if (args.length < 2) {
      System.out.println("Usage: FriendlyScannerStopper ipAddr port")
      return
    }

    val udpSocket : DatagramSocket = new DatagramSocket();
    val packetContents : String = "SIP/2.0 400 Go Away!!!\r\n\r\n"
    udpSocket.send(new DatagramPacket(packetContents.getBytes("utf-8"), packetContents.size,
      InetAddress.getByName(args(0)), Integer.parseInt(args(1))))
  }
}
END
scala UnfriendlyScannerStopper.scala 188.138.107.179 5102

You will need to substitute 188.138.107.179 and 5102 for the address and port in the Via header of the SIP packets you are being sent in the attack.

share|improve this answer
    
If you wrote that as a service that would reply to anything you could tell fail2ban to setup iptables rules to forward to that service. –  Grant Oct 28 '13 at 22:12
add comment

Talk to your upstream provider. Mine has a blacklist with a REST API that I can feed IP addresses to. I set up fail2ban to call this webservice and packets are stopped somewhere in my provider's network before they reach my firewalls.

share|improve this answer
add comment

these iptables rules work fine for me. They keep the CPU load under 2% during such attacks.

http://txlab.wordpress.com/2013/06/29/protecting-a-vpbx-from-dos-attacks/

share|improve this answer
add comment

No one directly answered your question, so: NO

You cannot prevent someone from sending packets to your perimeter gateway. The best you can do is stop them upstream (as longneck mentioned above), or stop them at your firewall.

Fail2ban will trigger based on a count of failed attacks (as you already noted above), so an alternative (or combination) is to block based on the geographic location of the source ip. Products like SecAst or some hardware firewalls can block based on Geographic location which will further reduce the number of packets arriving at your server.

Back to your original question: NO

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.