Everything here runs before the switch touches Redis, so attack traffic costs almost nothing.
Rate limiting is applied to every address this set does not contain — so right now that would be every address, your customers and your vendors included. The switch turns rate limiting OFF entirely in this state rather than banning everybody, but nothing is being rate-limited at all until it is fixed.
Check that customer_trunks and
vendor_gateways have active rows, and that the engine can read
them: make sec-check.
By rule, because a single total cannot tell a working filter from a broken one.
| Rule | Messages |
|---|---|
| already banned One hash lookup each. This is what makes an attack cheap for us. |
not readable |
| on the permanent drop list Published from MySQL. |
not readable |
| announced itself as a scanner The cheapest check, and never the only one. |
not readable |
| too many requests Unknown sources only — a known customer is never rate-limited. |
not readable |
| not a customer and not a vendor If a new customer’s traffic is not arriving, it is in here. |
not readable |
| tried to end a call that is not theirs A BYE or CANCEL that matched no dialog, or came from the wrong address. |
not readable |
| a CUSTOMER or VENDOR sending a scanner header Their box is compromised or somebody is spoofing them. Never banned — ring them. |
not readable |
| rules the switch could not parse Must be zero. Anything else is a rule protecting nothing. |
not readable |
The counters above say how much. This says who, and it is the only thing that turns “my calls stopped” into an answer. It is capped per minute on purpose: a scan from ten thousand addresses must not become ten thousand writes.
Nothing recently. That is either a quiet hour or a filter that is not running — the counters above tell the two apart.
No rules.
| Setting | Value |
|---|---|
| known customer trunks | |
| known vendor gateways | |
| rate limit (unknown sources only) | per s |
| ban after | failures |
| ban lasts | s |
| RTP strict-source | off |
Refreshes every 20 seconds. On the command line:
make sec-check, make sec-seen,
make sec-bans, make sec-unban IP=....