Understanding Log Entry


(John) #1

Hello,

Can someone help me understand these log entries:

[2020-03-30 04:48:21] ERROR[9722] pjproject: sip_transport.c Error processing 393 bytes packet from UDP 37.49.226.118:54632 : PJSIP syntax error exception when parsing 'Contact' header on line 8 col 10:
REGISTER sip:xxx.xxx.xxx.xxx SIP/2.0
Via: SIP/2.0/UDP 37.49.226.118:54632;branch=z9hG4bK-2271119571;rport
Max-Forwards: 70
To: "Grandstream"<sip:100@1.1.1.1>
From: "Grandstream"<sip:100@1.1.1.1>;tag=3935316334303662313363340132353136393534313836
User-Agent: friendly-scanner
Call-ID: 257939888571853077765854
Contact: None
CSeq: 1 REGISTER
Accept: application/sdp
Content-Length: 0


-- end of packet.

I changed our FreePBX IP in the above log to xxx.xxx.xxx.xxx.

Thanks,
John


(Lorne Gaetz) #2

Notwithstanding their stated intent to be ‘friendly’, this is a bot scanning for vulnerabilities by attempting to REGISTER to your PBX.


(Joshua C. Colp) #3

And PJSIP blocked it almost immediately because they’ve violated the SIP specification, and the REGISTER request is invalid.


(John) #4

@lgaetz + @jcolp - So it is not something I should worry about, or is there some action I should take?


#5

Adjust your hardware and/or FreePBX firewall to deny access to port 5060, except from authorized endpoints and trunks.


(system) closed #6

This topic was automatically closed 31 days after the last reply. New replies are no longer allowed.