FreePBX 16 fail2ban log

I just did sngrep on 2 of our PBXs and it looks like some extensions have a lot more traffic than the others. Some extensions only register and receive 200 OK message and that’s it. But other extensions for some reason try to register a bunch of times, then receive Unauthorized message, then try again and receive 200 OK message, and it goes on and on. It looks like those extensions are cluttering the resources on the server.

What could that be? All of the passwords are correct and in the web gui all extensions are registered and working.

What chanel tech are you using? default chan_sip will ‘alwaysauthreject’ until the caller better identifies

We always use pjsip and a custom port number. This is only happening with Adtrans on as clients. When I sngrep the PBX that has only Audiocodes ATAs, the results look very clean.

To answer “What could that be?”, I would suggest misconfiguration of the adtrans device perhaps or perhaps that they just behave that way, (quite normal in my experience) :slight_smile:

Just checked again and on the Audiocodes PBX it happens once in a while, but just not as many unauthorized and then OK messages as with the Adtrans. Why do they get unauthorized first and then are allowed to register I don’t get it?

It is an age old prophylactic method to make sure the caller is actually who they say they are, (SIP over UDP is quite lax with security and checks)

I’m kind of confused here. When I sngrep on these congested PBXs, it looks like these authorizations are just constantly happening. Why are the constantly happening if our Adtrans are only configured to expire every 5 minutes? And again, is there any way to just let it authorize and wait until another successful attempt? I’m really confused with the sngrep output.

I just found the problem. For some reason when we configured the Adtrans to expire in 300 seconds, they would constantly expire every 5 seconds, not within desired 300 seconds. Maybe a config glitch in the Adtrans. Putting them back to default 3600 seconds fixed the issue.

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.