Security question.

[cpiga]

This is a decoded ethernet frame sniffed from my ATA ethernet port:

Session Initiation Protocol
Status-Line: SIP/2.0 401 Unauthorized
Status-Code: 401
[Resent Packet: False]
Message Header
Via: SIP/2.0/UDP 192.168.10.71:5060;branch=z9hG4bK-a7ff22d5;rport=61264;received=89.149.202.61
Transport: UDP
Sent-by Address: 192.168.10.71
Sent-by port: 5060
Branch: z9hG4bK-a7ff22d5
RPort: 61264
Received: 89.149.202.61
From: Carlo <sip:2531**@64.34.173.199>;tag=7083ccabd59256aao 0
SIP Display info: Carlo
SIP from address: sip:2531**@64.34.173.199
SIP tag: 7083ccabd59256aao0
To: Carlo <sip:253104@64.34.173.199>;tag=c71e87f21af06a79a7f 28931077856d8.9273
SIP Display info: Carlo
SIP to address: sip:253104@64.34.173.199
SIP tag: c71e87f21af06a79a7f28931077856d8.9273
Call-ID: 3f043792-35d31042@192.168.*.*
CSeq: 36698 REGISTER
Sequence Number: 36698
Method: REGISTER
WWW-Authenticate: Digest realm="voxalot.com", nonce="46b86fcda130483fdea9a19e65a1dab74a04243e", stale=true
Authentication Scheme: Digest
Realm: "voxalot.com"
Nonce Value: "46b86fcda130483fdea9a19e65a1dab74a04243e"
Stale Flag: true
Server: OpenSer (1.1.0-notls (i386/linux))
Content-Length: 0
Warning: 392 64.34.173.199:5060 "Noisy feedback tells: pid=14861 req_src_ip=89.149.202.61 req_src_port=61264 in_uri=sip:64.34.173.199 out_uri=sip:64.34.173.199 via_cnt==1"

In the last line there is the source ip 89.149.202.61, it isn't my pubblic ip address, and a dns lookup tells:

61.202.149.89.in-addr.arpa. 41061 IN PTR 89-149-202-61.internetserviceteam.com.

There is someone registering to my voxalot account from that address??!!??

[martin]

Questions:

1. Are you Carlo?
2. Is 192.168.10.71 your internal IP address?

Originally Posted by cpiga

This is a decoded ethernet frame sniffed from my ATA ethernet port:

Session Initiation Protocol
Status-Line: SIP/2.0 401 Unauthorized
Status-Code: 401
[Resent Packet: False]
Message Header
Via: SIP/2.0/UDP 192.168.10.71:5060;branch=z9hG4bK-a7ff22d5;rport=61264;received=89.149.202.61
Transport: UDP
Sent-by Address: 192.168.10.71
Sent-by port: 5060
Branch: z9hG4bK-a7ff22d5
RPort: 61264
Received: 89.149.202.61
From: Carlo <sip:2531**@64.34.173.199>;tag=7083ccabd59256aao 0
SIP Display info: Carlo
SIP from address: sip:2531**@64.34.173.199
SIP tag: 7083ccabd59256aao0
To: Carlo <sip:253104@64.34.173.199>;tag=c71e87f21af06a79a7f 28931077856d8.9273
SIP Display info: Carlo
SIP to address: sip:253104@64.34.173.199
SIP tag: c71e87f21af06a79a7f28931077856d8.9273
Call-ID: 3f043792-35d31042@192.168.*.*
CSeq: 36698 REGISTER
Sequence Number: 36698
Method: REGISTER
WWW-Authenticate: Digest realm="voxalot.com", nonce="46b86fcda130483fdea9a19e65a1dab74a04243e", stale=true
Authentication Scheme: Digest
Realm: "voxalot.com"
Nonce Value: "46b86fcda130483fdea9a19e65a1dab74a04243e"
Stale Flag: true
Server: OpenSer (1.1.0-notls (i386/linux))
Content-Length: 0
Warning: 392 64.34.173.199:5060 "Noisy feedback tells: pid=14861 req_src_ip=89.149.202.61 req_src_port=61264 in_uri=sip:64.34.173.199 out_uri=sip:64.34.173.199 via_cnt==1"

In the last line there is the source ip 89.149.202.61, it isn't my pubblic ip address, and a dns lookup tells:

61.202.149.89.in-addr.arpa. 41061 IN PTR 89-149-202-61.internetserviceteam.com.

There is someone registering to my voxalot account from that address??!!??

[cpiga]

Originally Posted by martin

Questions:

1. Are you Carlo?
2. Is 192.168.10.71 your internal IP address?

Yes I'm Carlo and 192.168.10.71 is my internal ip address, but my external address isn't the other one.

[martin]

Originally Posted by cpiga

Yes I'm Carlo and 192.168.10.71 is my internal ip address, but my external address isn't the other one.

A traceroute to your IP address goes via the 89.149.*.* subnet. I suspect our NAT handling logic is deriving this address.
.