Re: SIP VoIP botnet question

2010-09-19 Thread Stuart Henderson
On 2010-09-18, packetfilte...@gmail.com wrote: > Hi > > Can someone shed some light on the following (pfSense) PF log entries; Don't know pfSense, but these logs appear to show the firewall blocking some traffic that you told it to block. > I've been experiencing a lot of problems when trying to

Re: SIP VoIP botnet question

2010-09-19 Thread Henning Brauer
* packetfilte...@gmail.com [2010-09-18 23:34]: > Can someone shed some light on the following (pfSense) PF log entries; wrong list. some ancient (that is the very friendly wording) pf version on some OS that isn't OpenBSD which has been modified. how would we know? -- Henning Brauer, h...@bsw

Re: SIP VoIP botnet question

2010-09-19 Thread Mark R
install ngrep and run ngrep -q -t -P "" -W byline -d ng0 SIP Should show the sip packets in a more friendly format. On Sat, Sep 18, 2010 at 10:29 PM, packetfilte...@gmail.com < packetfilte...@gmail.com> wrote: > Hi > > Can someone shed some light on the following (pfSense) PF log entries; > >

SIP VoIP botnet question

2010-09-18 Thread packetfilte...@gmail.com
Hi Can someone shed some light on the following (pfSense) PF log entries; 36. 281054 rule 80/0(match): block in on ng0: (tos 0x0, ttl 45, id 51305, offset 0, flags [DF], proto UDP (17), length 437) 124.92.251.2.5060 > 91.84.205.47.5060: SIP, length: 409 OPTI\200\242\224LL\223\006\000`\000\0