來自未知對等方的傳入 SIP 連接淹沒了 Asterisk

您好，我剛剛使用 freepbx 安裝了一個新的星號配置並註冊了一個 SIP 帳戶。

我使用我的提供商數據設置了 SIP 中繼，使用星號 -vvvr命令啟動控制台進行調試，然後我注意到日誌被以下條目淹沒：

== Using SIP RTP CoS mark 5
-- Executing [00088884600972595117946@from-sip-external:1] NoOp("SIP/XXX.XXX.58.107-00000355", "Received incoming SIP connection from unknown peer to 00088884600972595117946") in new stack
-- Executing [00088884600972595117946@from-sip-external:2] Set("SIP/XXX.XXX.58.107-00000355", "DID=00088884600972595117946") in new stack
-- Executing [00088884600972595117946@from-sip-external:3] Goto("SIP/XXX.XXX.58.107-00000355", "s,1") in new stack
-- Goto (from-sip-external,s,1)
-- Executing [s@from-sip-external:1] GotoIf("SIP/XXX.XXX.58.107-00000355", "1?checklang:noanonymous") in new stack
-- Goto (from-sip-external,s,2)
-- Executing [s@from-sip-external:2] GotoIf("SIP/XXX.XXX.58.107-00000355", "0?setlanguage:from-trunk,00088884600972595117946,1") in new stack
-- Goto (from-trunk,00088884600972595117946,1)
-- Executing [00088884600972595117946@from-trunk:1] Set("SIP/XXX.XXX.58.107-00000355", "__FROM_DID=00088884600972595117946") in new stack
-- Executing [00088884600972595117946@from-trunk:2] NoOp("SIP/XXX.XXX.58.107-00000355", "Received an unknown call with DID set to 00088884600972595117946") in new stack
-- Executing [00088884600972595117946@from-trunk:3] Goto("SIP/XXX.XXX.58.107-00000355", "s,a2") in new stack
-- Goto (from-trunk,s,2)
-- Executing [s@from-trunk:2] Answer("SIP/XXX.XXX.58.107-00000355", "") in new stack
-- <SIP/XXX.XXX.58.107-00000352> Playing 'digits/8.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-00000351> Playing 'digits/9.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-0000034f> Playing 'digits/6.ulaw' (language 'en')
-- Executing [s@from-trunk:5] SayAlpha("SIP/XXX.XXX.58.107-00000353", "00088884400972595117946") in new stack
-- <SIP/XXX.XXX.58.107-00000353> Playing 'digits/0.ulaw' (language 'en')
-- Executing [s@from-trunk:3] Wait("SIP/XXX.XXX.58.107-00000355", "2") in new stack
-- <SIP/XXX.XXX.58.107-00000350> Playing 'digits/1.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-00000352> Playing 'digits/8.ulaw' (language 'en')
-- Executing [s@from-trunk:6] Hangup("SIP/XXX.XXX.58.107-0000034f", "") in new stack
== Spawn extension (from-trunk, s, 6) exited non-zero on 'SIP/XXX.XXX.58.107-0000034f'
-- Executing [h@from-trunk:1] Macro("SIP/XXX.XXX.58.107-0000034f", "hangupcall,") in new stack
-- Executing [s@macro-hangupcall:1] GotoIf("SIP/XXX.XXX.58.107-0000034f", "1?theend") in new stack
-- Goto (macro-hangupcall,s,3)
-- Executing [s@macro-hangupcall:3] ExecIf("SIP/XXX.XXX.58.107-0000034f", "0?Set(CDR(recordingfile)=)") in new stack
-- Executing [s@macro-hangupcall:4] Hangup("SIP/XXX.XXX.58.107-0000034f", "") in new stack
== Spawn extension (macro-hangupcall, s, 4) exited non-zero on 'SIP/XXX.XXX.58.107-0000034f' in macro 'hangupcall'
== Spawn extension (from-trunk, h, 1) exited non-zero on 'SIP/XXX.XXX.58.107-0000034f'
-- <SIP/XXX.XXX.58.107-00000351> Playing 'digits/7.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-00000350> Playing 'digits/1.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-00000353> Playing 'digits/0.ulaw' (language 'en')
-- <SIP/XXX.XXX.58.107-00000352> Playing 'digits/4.ulaw' (language 'en')

我只是無法調試我的中繼，因為來自未知對等方的那些討厭的連接，這些呼叫是什麼，我如何跟踪它們的來源，它可能是我的提供商的故障測試工具嗎？

即使關閉了 GUEST，您的 Asterisk 伺服器仍然會受到 SIP 黑客攻擊的攻擊。您應該安裝更多的東西來監控和管理攻擊。查看Asterisk Security以獲得建議，甚至是如何保護 Asterisk 伺服器的基礎知識。（客串還不夠）

我想這一切都取決於 - 我假設您在某種 Linux 上執行 Asterisk？我已經多次這樣做了，這里和那裡可能有點棘手。但是 - 在調試方面，有許多工具可以提供幫助。

• 例如，可以使用 IPTables 阻止未知客戶端。如果您知道您的呼叫應該來自哪裡，您可以設置防火牆規則來阻止除此之外的任何內容。這就是我所做的——確保只有我自己的客戶以及任何上游 PBX 系統才能通話。
• 要弄清楚未知客戶端的真實身份，您可以使用Wireshark之類的工具根據類型等過濾連接。這通常可以清晰地了解正在發生的事情。

這些只是指針。您可能想詳細說明一下您的設置 - 然後我可能會更具體。

引用自：https://serverfault.com/questions/671561