Patrick,
Thanks for responding. I looked at your initial suggestions.
A DoS seems very unlikely as there's negligible traffic being reported by the firewall router.
(I will, however, enable the Restrict Source IP option on both lines to see if it makes any
difference).
The reboot reason chart was where I found out that H737202d1 was an out-of-memory error.
The SPA2102 is on a wireless connection to the internet which occasionally drops out due to
weather and/or congestion at the local tower - hence my suspicion of a bug in timeout handling
or the handling of lost packets being the cause.
Please let me know if there is any additional information / logging that I could provide.
-- Mike --
UPDATE -
Seem to have solved the problem. Thanks Patrick!
Note that enabling the Restrict Source IP option does cause problems if you make (or receive) calls using IP dialling.
Rather than a targeted DoS attack it looks like there are a number of attempts being made to break into
VoIP systems on port 5060 using a brute force userid/password guessing attack. Presumably
the SPA-2102 fails when this happens. (Better log messages in next release?)
SANS Internet Storm Center http://isc.sans.edu/port.html?port=5060 gives some idea of the
number of attempts. This blog entry http://blog.tridgell.net/?p=28 describes a successful brute force
attack against an Asterisk server.
Looks like a bad idea to use the default 5060 port unless you have to.
Message was edited by: Michael Bell (added UPDATE)
