Our FreePBX box is being hit with a sequential extension attack of some sort. We have a few PBXs and we are seeing this on all of them. Does anybody know how to defend against this? Fail2Ban is not picking it up. This is what we see in the CDR logs. You can see the CallerID is incrementing, starting (in this example) at 22902 and continuing through 22931.
2014-05-02 15:45:36 1399063536.389040 22931 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389037 22928 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389039 22930 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389038 22929 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389036 22927 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389035 22926 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389034 22925 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:35 1399063535.389033 22924 Congestion s [from-sip-external] ANSWERED 00:12
2014-05-02 15:45:34 1399063534.389031 22922 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389032 22923 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389030 22921 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389029 22920 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389028 22919 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389027 22918 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389026 22917 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389024 22915 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389025 22916 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:34 1399063534.389023 22914 Congestion s [from-sip-external] ANSWERED 00:12
2014-05-02 15:45:33 1399063533.389022 22913 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389021 22912 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389020 22911 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389019 22910 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389018 22909 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389017 22908 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389016 22907 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389015 22906 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389014 22905 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389013 22904 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:33 1399063533.389012 22903 Congestion s [from-sip-external] ANSWERED 00:13
2014-05-02 15:45:32 1399063532.389011 22902 Congestion s [from-sip-external] ANSWERED 00:13