TIPS explanation of log files

[GrahamC]

Can someone explain to me what these logs mean? I had 150 calls last night apparently originating from my voip provider ( the freepbx log says src cha is sip/58.28.152.22-000.... ), and I see this in the log

[2014-07-03 07:10:01] VERBOSE[12465] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/myipaddress-000000ec'
[2014-07-03 07:10:20] WARNING[1797] chan_sip.c: Retransmission timeout reached on transmission 9751018d6bcfeef7c9b3d1c500bc96d3 for seqno 1 (Critical Response) -- See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 32000ms with no response
[2014-07-03 07:14:33] VERBOSE[1797] netsock2.c: == Using SIP RTP TOS bits 184
[2014-07-03 07:14:33] VERBOSE[1797] netsock2.c: == Using SIP RTP CoS mark 5
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [97500972595561294@from-sip-external:1] NoOp("SIP/myipaddress-000000ed", "Received incoming SIP connection from unknown peer to 97500972595561294") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [97500972595561294@from-sip-external:2] Set("SIP/myipaddress-000000ed", "DID=97500972595561294") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [97500972595561294@from-sip-external:3] Goto("SIP/myipaddress-000000ed", "s,1") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Goto (from-sip-external,s,1)
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:1] GotoIf("SIP/myipaddress-000000ed", "0?checklang:noanonymous") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Goto (from-sip-external,s,5)
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:5] Set("SIP/myipaddress-000000ed", "TIMEOUT(absolute)=15") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] func_timeout.c: Channel will hangup at 2014-07-03 07:14:48.248 NZST.
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:6] Answer("SIP/myipaddress-000000ed", "") in new stack
[2014-07-03 07:14:33] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:7] Wait("SIP/myipaddress-000000ed", "2") in new stack
[2014-07-03 07:14:35] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:8] Playback("SIP/myipaddress-000000ed", "ss-noservice") in new stack
[2014-07-03 07:14:35] VERBOSE[12816] file.c: -- <SIP/myipaddress-000000ed> Playing 'ss-noservice.gsm' (language 'en')
[2014-07-03 07:14:40] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:9] PlayTones("SIP/myipaddress-000000ed", "congestion") in new stack
[2014-07-03 07:14:40] VERBOSE[12816] pbx.c: -- Executing [s@from-sip-external:10] Congestion("SIP/myipaddress-000000ed", "5") in new stack
[2014-07-03 07:14:46] VERBOSE[12816] pbx.c: == Spawn extension (from-sip-external, s, 10) exited non-zero on 'SIP/myipaddress-000000ed'
[2014-07-03 07:14:46] VERBOSE[12816] pbx.c: -- Executing [h@from-sip-external:1] Hangup("SIP/myipaddress-000000ed", "") in new stack
[2014-07-03 07:14:46] VERBOSE[12816] pbx.c: == Spawn extension (from-sip-external, h, 1) exited non-zero on 'SIP/myipaddress-000000ed'
[2014-07-03 07:15:05] WARNING[1797] chan_sip.c: Retransmission timeout reached on transmission b329d985fdf88134cf5c162f3dd18101 for seqno 1 (Critical Response) -- See https://wiki.asterisk.org/wiki/display/AST/SIP+Retransmissions
Packet timed out after 31999ms with no response

 

[GrahamC]

I've replaced my IP address with "myipaddress".
My iptables has whitelisted only my VOIP providers for UDP traffic on 5000-5068 ( I think ).

 

[drmurdoch]

Does your VOIP provider have logs ?
I wonder what IPs the calls come from originally.

 

[GrahamC]

Maybe I'm reading the freepbx report call log wrong, but the line 64 gives the sip address of my voip provider.

 

[drmurdoch]

GrahamC - are you still having the "about 13Gb of traffic on my server" issue still ?

 

[GrahamC]

drmurdoch no, traffic has greatly reduced since I whitelisted my voip providers.
As you say, perhaps it's now playing those no-service messages to these anon calls that is using up my traffic.

PS: at no time did any calls get routed through my PIAF instance, just annoying to see all this traffic which I have to pay for.

 

[GrahamC]

ok, am misreading the freepbx log .. that sip/58.28 ... is my IP address. I assumed it would give the IP address of the anonymous caller.

 

[drmurdoch]

ok, am misreading the freepbx log .. that sip/58.28 ... is my IP address. I assumed it would give the IP address of the anonymous caller.

You could probably set it up to do that.
Sounds like a good idea

 

[drmurdoch]

Edit: just wanted to mention that my IP tables restrict all external traffic to this box except that from Vitelity's domain:
AcceptIf protocol is UDP and source is outbound.vitelity.net and destination port is 5000:5082
AcceptIf protocol is UDP and source is 192.168.0.0/255.255.0.0 and destination port is 5000:5082

On my firewall (DD-WRT) I have 2 Port Range Forwards:
1000-20000 UDP forwards to IP of my PBX
5060-5062 UDP forwards to IP of my PBX

Finally, Allow Anonymous Inbound SIP Calls is set to NO.

Do you have your IP tables restrict all external traffic to your box from your VOIP provider's IPs ?

 

[GrahamC]

I found this in my iptables

28 ACCEPT udp -- anywhere anywhere udp dpts:commplex-main:qcp

which I thought I removed last night, but it's back again. So, I've removed it again and saved iptables.
I've added explicit ACCEPTs for my VOIP providers.
Wondering if I should also remove this rule:

29 ACCEPT udp -- anywhere anywhere udp dpts:ndmp:dnp

but since it's referring to addresses 1000-2000 which are not open on the router ... I guess it won't matter.

 

[GrahamC]

And overnight no more SIP calls registering with Asterix.