SIP - perhaps botnet? anyone else seeing this?
Roland Dobbins
rdobbins at cisco.com
Fri Apr 10 09:18:58 UTC 2009
On Apr 10, 2009, at 4:45 PM, Leland E. Vandervort wrote:
> UDP SIP Control traffic in our netflow data.
Have you grabbed some packets in order to ensure it's actually SIP,
vs. something else on the same ports?
If it really is SIP-related, this could be caused by botted hosts
launching a SIP DDoS, or brute-forcing said SIP services in order to
steal service for resale, DoS someone else via the service at layer-7
(i.e., call avallanche), sent VoIP spam, et. al. You may have botted
hosts in your hosting space, as well as hosts being scanned as
potential targets for exploitation.
A quick search-engine query should reveal that this sort of thing has
been going on for quite some time; I believe there were some
convictions in NJ or somewhere else in the northeastern US within the
last year or so.
-----------------------------------------------------------------------
Roland Dobbins <rdobbins at cisco.com> // +852.9133.2844 mobile
Our dreams are still big; it's just the future that got small.
-- Jason Scott
More information about the NANOG
mailing list