On Wed, Aug 29, 2018, at 10:34 AM, sean darcy wrote: > I'm getting invites to very high ports every 30 seconds from a > particular ip address: > > Retransmitting #10 (NAT) to 5.199.133.128:52734: > SIP/2.0 401 Unauthorized > Via: SIP/2.0/UDP > 0.0.0.0:52734;branch=z9hG4bK1207255353;received=5.199.133.128;rport=52734 > From: <sip:37120116780191250@67.80.191.250>;tag=1872048972 > To: <sip:3712011972592181418@67.80.191.250>;tag=as3a52e748 > Call-ID: 1504207870-295758084-609228182 > CSeq: 1 INVITE > ....... > WARNING[150318]: chan_sip.c:4127 retrans_pkt: Timeout on > 1504207870-295758084-609228182... > > I thought invites had to go to port 5060 or so. I don't understand why > somebody (let's assume a bad guy) is trying ports above 50000.
There is nothing that explicitly states that it has to be 5060, and in the case of the above it's just a random source port. -- Joshua Colp Digium, Inc. | Senior Software Developer 445 Jan Davis Drive NW - Huntsville, AL 35806 - US Check us out at: www.digium.com & www.asterisk.org -- _____________________________________________________________________ -- Bandwidth and Colocation Provided by http://www.api-digital.com -- Astricon is coming up October 9-11! Signup is available at: https://www.asterisk.org/community/astricon-user-conference Check out the new Asterisk community forum at: https://community.asterisk.org/ New to Asterisk? Start here: https://wiki.asterisk.org/wiki/display/AST/Getting+Started asterisk-users mailing list To UNSUBSCRIBE or update options visit: http://lists.digium.com/mailman/listinfo/asterisk-users