| Event Id | 16436 |
| Source | Live Communications Server |
| Description | There were 16 unauthorized messages in the last 5537 minutes. The last one had the FROM header: sip:u...@domain.com |
| Event Information | This information from some newsgroups may help you: ------------------------------------------------------------------------------ When a user logs in, for the first time the request he sends to the server is not authenticated, for which the server sends a SIP challenge response to which the client provides the right credentials and establishes SA with the server. There is currently no good way to distinguish between the first unauthenticated request sent by a regular good client and requests sent by unauthenticated rogue client trying to attack the server. This event log just says how many unauthenticated requests the server received in the last x minutes.In proper deployments these are benign event logs generated by regular clientsBut in the case of some kind of attack this event logs will give a hint of what is happening in the network. When a user logs in, for the first time the request he sends to the server is not authenticated. The server sends a SIP challenge response to which the client provides the right credentials and establishes a secure connection with the server. There is currently no good way to distinguish between the first unauthenticated request sent by a regular good client and requests sent by unauthenticated client trying to attack the server. This event log just says how many unauthenticated requests the server received in the last minutes. In proper deployments these are event logs generated by regular clients. But in the case of some kind of attack, this event logs will give a hint of what is happening in the network. ------------------------------------------------------------------------------ |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.