--- title: Defend the BroadWorks XSP from Device Management Scanning - ECG description: Background The Cisco BroadWorks Device Management System (DMS) delivers configuration files for SIP devices on Cisco BroadWorks platforms. Each time a devi image: https://www.ecg.co/hubfs/Imported_Blog_Media/regular_dima-pechurin-JUbjYFvCv00-unsplash-1.jpg --- [![ECG](https://www.ecg.co/hubfs/lp/cloud-migration/logo-vector.svg)](https://www.ecg.co) - Who We Are Company [**About ECG** Learn about the team behind the networks and services that solve real problems.](https://www.ecg.co/about) [**Careers** Join a fun, collaborative, engineer-owned company.](https://www.ecg.co/careers) Industries We Serve [**Enterprises** Optimize multi-site voice networks while meeting compliance requirements.](https://www.ecg.co/sectors/enterprise) [**Universities** Professional services designed for the unique needs of campus networks.](https://www.ecg.co/sectors/universities) [**Government** Engineering services built for government agency voice challenges.](https://www.ecg.co/sectors/government) [**Service Providers** Deep voice expertise to maintain compliance and keep customers connected.](https://www.ecg.co/sectors/service-providers) - Technologies **Carrier & Trunking Services** SIP trunking, resilience & carrier interconnect **Compliance & Call Authentication** STIR/SHAKEN, 603+ & secure signaling **Unified Communications & Collaboration** UC capabilities & platform expertise **Platform Reliability & Security** Infrastructure, capture & network fundamentals ### Carrier & Trunking Services Design, harden, and secure the carrier side of your voice network — from SIP trunking to encrypted media and compliant recording. [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) ### Compliance & Call Authentication Meet regulatory requirements end-to-end — call authentication, robocall mitigation, lawful capture, and encrypted signaling. [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) ### Unified Communications & Collaboration Modern UC capabilities backed by deep, hands-on expertise across every major voice platform. [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) ### Platform Reliability & Security The infrastructure layer underneath your voice services — engineered, monitored, and secured by people who run it every day. [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) - How We Do It Services [**Services Overview** Our experience and expertise in voice and data engineering.](https://www.ecg.co/services) [**Network Operations** Keep your voice network running with outsourced network operations.](https://www.ecg.co/services/network-operations) [**Staff Augmentation** Expert engineering support to meet deadlines and fill knowledge gaps.](https://www.ecg.co/services/staff-augmentation) [**IT Consulting & Engineering** Complete short-term projects faster with a dedicated project manager.](https://www.ecg.co/services/it-consulting-and-engineering) - Resources #### [Utilities Launch Delay Calculator Estimate what a potential product launch delay would cost your business. Try the calculator](https://www.ecg.co/cost-delay-calculator) #### [Resource Library Guides, White Papers & Tools In-depth resources on voice engineering, compliance, and AI — built from real client work. Explore resources](https://www.ecg.co/resource-library) #### [Blog Latest from the ECG Team Practical articles on SIP, UC platforms, network operations, and voice AI. Read the blog](https://www.ecg.co/blog) - [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) Who We Are [About ECG](https://www.ecg.co/about) [Careers](https://www.ecg.co/careers) Industries We Serve [Enterprises](https://www.ecg.co/sectors/enterprise) [Universities](https://www.ecg.co/sectors/universities) [Government](https://www.ecg.co/sectors/government) [Service Providers](https://www.ecg.co/sectors/service-providers) Technologies Carrier & Trunking Services [SIP Trunking](https://www.ecg.co/technologies/sip-trunking-consulting-expertise) [SIP Trunking High Availability](https://www.ecg.co/technologies/sip-trunking-high-availability) [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [eSIM & FMC](https://www.ecg.co/technologies/esim-fmc) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) Compliance & Call Authentication [STIR/SHAKEN](https://www.ecg.co/technologies/stir-shaken) [603+](https://www.ecg.co/technologies/603-plus-do-not-originate) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VoIP TLS & SRTP](https://www.ecg.co/technologies/voip-encryption-tls-srtp) Unified Communications & Collaboration [E911](https://www.ecg.co/technologies/e911) [Business Texting](https://www.ecg.co/technologies/business-texting) [Teams Replace Phone System](https://www.ecg.co/technologies/ms-teams-replace-phone-system) [Provisioning & Endpoint Mgmt](https://www.ecg.co/technologies/sip-provisioning-endpoint-management) [Call Control & Features](https://www.ecg.co/technologies/call-control-features) [SIP Trunking HA](https://www.ecg.co/technologies/sip-trunking-high-availability) [SIPREC](https://www.ecg.co/technologies/siprec-call-recording) [vCon](https://www.ecg.co/technologies/vcon-virtualized-conversations) Platform Expertise [BroadWorks](https://www.ecg.co/technologies/broadworks) [NetSapiens](https://www.ecg.co/technologies/netsapiens-support) [Metaswitch Alianza Core](https://www.ecg.co/technologies/metaswitch-alianza-core) [Oracle Communications](https://www.ecg.co/technologies/oracle-communications-support) [Metaswitch Perimeta](https://www.ecg.co/technologies/metaswitch-perimeta) [Sansay VSXi](https://www.ecg.co/sansay-vsxi-session-border-controller) Platform Reliability & Security [EKS / Kubernetes](https://www.ecg.co/technologies/kubernetes-eks) [Critical Network Fundamentals](https://www.ecg.co/technologies/critical-network-fundamentals) [Packet Capture / PCAP](https://www.ecg.co/technologies/pcap-wireshark-packet-capture-analysis) [VMware & Alternatives](https://www.ecg.co/technologies/vmware-alternatives) [Routing, Switching & Firewalls](https://www.ecg.co/technologies/routing-switching-firewalls) [Freeswitch](https://www.ecg.co/technologies/freeswitch-open-source-call-processing) How We Do It Services [Services Overview](https://www.ecg.co/services) [Network Operations](https://www.ecg.co/services/network-operations) [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) Resources [Launch Delay Calculator](https://www.ecg.co/cost-delay-calculator) [Guides, White Papers & Tools](https://www.ecg.co/resource-library) [Latest from the ECG Team](https://www.ecg.co/blog) [Events](https://www.ecg.co/events) [Login](https://portal.ecg.co) [Contact](https://www.ecg.co/contact) # Defend the BroadWorks XSP from Device Management Scanning Attacks By: Mark Lindsey 8 min read Sep 17, 2020 ## Background The Cisco BroadWorks Device Management System (DMS) delivers configuration files for SIP devices on Cisco BroadWorks platforms. Each time a device boots, it downloads its configuration file. The configuration file includes the essential details necessary to REGISTER via SIP and access the services. The same essential details can be used by criminal bad actors to use SIP to attack a service provider. By identifying the Session Border Controller (SBC), SIP username and password, the attacker can REGISTER with the service and commit illegal actions to defraud the service provider of revenue. - **Direct Toll Fraud** occurs when attackers place calls without intending to pay for them. In some cases, these calls have been connected to calling cards, so that unwitting users intending to place calls to expensive-to-call destinations are actually routing their calls through a system fraudulently. - **Traffic Pumping** occurs when bad actors generate calls to a platform. They then receive income through the platform that receives those calls. | Bandwidth.com further describes these activities and gives tecommendations to avoid problems. [Read More.](https://support.bandwidth.com/hc/en-us/articles/360033476174-Recommended-voice-fraud-mitigation-best-practices) | | --- | Bad actors have long scanner Session Border Controllers (SBCs) for vulnerable SIP accounts. But more recently, attackers are also scanning for unprotected SIP phone configuration files. ## Best Prevention: Mutual TLS Authentication The best approach to protecting SIP Device Management Files is Mutual TLS authentication. With this technology, the Device Management Server receives a request for a file, and checks to see if that request came from a device with a proper TLS Certificate. In the best cases, the TLS Certificate was added by the Manufacturer of the SIP Device, and cannot be directly mimicked by an attacker. For example, a Poly device would provide a certificate signed by Poly, Inc., and an Algo device would provide a certificate signed by Algo. This allows the Device Management Server to ensure that the configuration files with all their sensitive data are provided only to the proper device types. And it ensure that attackers will not be able to retrieve the configuration files, because the certificates (and their corresponding private keys) are protected by these manufacturers from attack. However, many service providers do not have Mutual TLS Authentication. To set it up, you can use BroadWorks R22 built-in TLS Mutual Authentication capability in some cases. But in many other scenarios you need the flexibility of a programmable device like the F5 Labs Local Traffic Manager (LTM). But what if you don't have Mutual TLS and you're getting attacked?  ## Detecting Scanning You can observe scanning on BroadWorks by looking for 404 messages in the tomcat logs. For example, on this BroadWorks XSP (R22), we scan for /dms requests that fail and see many requests coming from one attacker IP address, 94.26.117.83. The 404 response code in these log entries show that the requests are failing. ``` bwadmin@xsp1$ zgrep '/dms.*404' /var/broadworks/logs/tomcat/access_log.*.gz| head 94.26.117.83 - - [14/Aug/2020:19:20:14 -0400] "GET /dms/Cisco504/000e084c8fdb.xml HTTP/1.1" 404 - - 0.046 46 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:14 -0400] "GET /dms/cisco504/000e084c8fdb.xml HTTP/1.1" 404 - - 0.031 31 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:15 -0400] "GET /dms/Cisco504/000e084c8fdb.xml HTTP/1.1" 404 - - 0.006 6 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:15 -0400] "GET /dms/Cisco504/000e081717dd.xml HTTP/1.1" 404 - - 0.016 16 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:15 -0400] "GET /dms/cisco504/000e081717dd.xml HTTP/1.1" 404 - - 0.005 5 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:15 -0400] "GET /dms/Cisco504/000e0818471b.xml HTTP/1.1" 404 - - 0.010 10 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:16 -0400] "GET /dms/cisco504/000e0818471b.xml HTTP/1.1" 404 - - 0.006 6 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:16 -0400] "GET /dms/Cisco504/000e081717dd.xml HTTP/1.1" 404 - - 0.008 8 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:16 -0400] "GET /dms/Cisco504/000e084c8fdb.xml HTTP/1.1" 404 - - 0.006 6 "-" "Cisco/SPA504G-7.5.5" "-" 94.26.117.83 - - [14/Aug/2020:19:20:16 -0400] "GET /dms/cisco504/000e084c8fdb.xml HTTP/1.1" 404 - - 0.007 7 "-" "Cisco/SPA504G-7.5.5" "-" ``` ## Problems Due to Scanning BroadWorks XSP servers providing DMS can be, in effect, "attacked" by bad actors scanning for SIP configuration files. High speed scanning on a BroadWorks DMS can cause the services of the XSP to be interrupted, and create unnecessary workload on the Network Server and the Application Server. You'll see alarms including: - bwProtocolRegistrationFailure - bwMemoryOverAllocation ## Blocking Scanners: F5 Labs Local Traffic Manager (LTM) To block scanners, the ideal approach is to use a Network Device like the F5 Labs Local Traffic Manager (LTM) with a configuration that detects failed requests and then blocks those source IPs that make too many requests that fail. If you're adding an F5 Labs LTM to your network to improve Mutual TLS Authentication, then you can get immediate use from the device in this way. Upsides: - Keeps the blocking and security configuration in a single device built for security - Simplifies the configurations on the XSPs - Scales up efficiently even as more XSPs are added to th enetwork ## Blocking Scanners: Open Source Solution with fail2ban In the absence of a Network Device to support the XSP, the open source tool fail2ban can be used to monitor the XSP log files and ban attackers automatically. It uses the iptables rules in Linux to block traffic coming from attacker devices. Upsides: - Free, open source tool works on all Linux systems supported by BroadWorks - Effectively blocks attackers to prevent scanning and system overload ## Setup Guide: fail2ban for XSP on CentOS **Step 1** Become root, and install the epel-release repository and install the fail2ban package. ``` bwadmin@xsp1$ su Password: ********** root@xsp1# yum install epel-release root@xsp1# yum install fail2ban ```   **Step 2** Create an initial configuration file. ``` root@xsp1# cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local ```   **Step 3** Setup a new filter to recognize scanning in the BroadWorks Tomcat logs. ``` root@xsp1#  cat > /etc/fail2ban/filter.d/broadworks-dms.conf << vEOF [Definition] failregex = ^ - .* "(GET|POST|HEAD).*/dms.*HTTP.*" 404 .*$ vEOF root@xsp1# cat >> /etc/fail2ban/jail.local << vEOF [broadworks-dms] enabled = true port = http,https filter = broadworks-dms logpath = /var/broadworks/logs/tomcat/access_log*.txt bantime = 3600 findtime = 600 ## Every 10 minutes = 600 seconds... maxretry = 5 ## Allow 5 failed attempts vEOF ``` Note that we've observed attackers dynamically slowing down their attack rate to continue to scan at lower speeds, such as 10 attempts every 35 minutes. You may have to tune findtime and maxretry, or just accept that slow attacks will always happen.   **Step 4** Setup tool to recognize when BroadWorks rotates the tomcat logs. ``` root@xsp1# cat > /etc/fail2ban/filter.d/broadworks-dms_rescan.sh << vEOF #!/bin/bash - ## fail2ban does not notice files when BroadWorks creates them, so it has to be told to rescan the files. old_file_list=/var/tmp/`basename $0`.old_file_list.txt t=`mktemp` ls -1tr /var/broadworks/logs/tomcat/access_log*.txt > "$t" if ! cmp --quiet "$t" "$old_file_list" ; then cp "$t" "$old_file_list"  service fail2ban reload  systemctl start fail2ban fi vEOF ```   **Step 5** Setup Linux to start fail2ban automatically. ``` root@xsp1# service fail2ban start # Works on CentOS or RHEL 6 root@xsp1# chkconfig fail2ban on # Works on CentOS or RHEL 6 root@xsp1# systemctl start fail2ban # Works on CentOS or RHEL 7 root@xsp1# systemctl enable fail2ban # Works on CentOS or RHEL 7 ```   **Step 6** Setup tool to recognize when BroadWorks rotates the tomcat logs. Then restart fail2ban. ``` root@xsp1# chmod 755 /etc/fail2ban/filter.d/broadworks-dms_rescan.sh ```   **Step 7** Setup the rescanner to run every minute. ``` root@xsp1# cat > /etc/cron.d/fail2ban_broadworks-dms_rescan << vEOF SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ * * * * * root /etc/fail2ban/broadworks-dms_rescan.sh vEOF ```   [broadworks](https://www.ecg.co/blog/tag/broadworks) [security](https://www.ecg.co/blog/tag/security) [dms](https://www.ecg.co/blog/tag/dms) [xsp](https://www.ecg.co/blog/tag/xsp) [attackers](https://www.ecg.co/blog/tag/attackers) [cisco,](https://www.ecg.co/blog/tag/cisco) [cybersecurity](https://www.ecg.co/blog/tag/cybersecurity) ## Similar posts [![Cisco BroadWorks New Features Show Focus on AI & Mobility - Spring 2025](https://www.ecg.co/hubfs/AI-Generated%20Media/Images/People%20around%20the%20world%20use%20smartphones%20talk%20on%20calls%20Both%20professionals%20and%20young%20people%20are%20depicted%20Outdoor%20scenes%20emphasize%20nature%20and%20mobility%20and%20adventure%20and%20excitement%20Australia%20Japan%20the%20US%20and%20France%20are%20highlighted-1.jpeg)](https://www.ecg.co/blog/cisco-broadworks-new-features-show-focus-on-ai-mobility-2025) ### [Cisco BroadWorks New Features Show Focus on AI & Mobility - Spring 2025](https://www.ecg.co/blog/cisco-broadworks-new-features-show-focus-on-ai-mobility-2025) [![Alpaca – Hassle-Free BroadWorks Management with Flexible Pricing](https://www.ecg.co/hubfs/Imported_Blog_Media/regular_shutterstock_2016196394-1.jpg)](https://www.ecg.co/blog/168-alpaca-hassle-free-broadworks-management-with-flexible-pricing) ### [Alpaca – Hassle-Free BroadWorks Management with Flexible Pricing](https://www.ecg.co/blog/168-alpaca-hassle-free-broadworks-management-with-flexible-pricing) [![Infographic: Simplify BroadWorks Management With Alpaca](https://www.ecg.co/hubfs/ecg-site/blog-listing-placeholder.jpg)](https://www.ecg.co/blog/167-infographic-simplify-broadworks-management-with-alpaca) ### [Infographic: Simplify BroadWorks Management With Alpaca](https://www.ecg.co/blog/167-infographic-simplify-broadworks-management-with-alpaca) ## Need Help With Your Network or AI Project? Get expert advice from engineers who've solved complex problems for carriers, enterprises, and government agencies. [Let's Talk](https://www.ecg.co/contact) [![ecg-logo-white](https://www.ecg.co/hubfs/ecg-site/global/ecg-logo-white.svg "ecg-logo-white")](https://www.ecg.co/) 505 North Toombs St. Suite A Valdosta, Georgia 31601 USA #### Headquarters - 1.866.324.0700 US Toll-free - 1.229.244.2099 International - 1.229.244.2399 Fax - [info@e-c-group.com](mailto:info@e-c-group.com) #### Services - [Overview](https://www.ecg.co/services) - [Network Operations](https://www.ecg.co/services/network-operations) - [Custom AI Development](https://www.ecg.co/services/custom-ai-development) - [Outsourced NOC Support](https://www.ecg.co/services/outsourced-noc-support) - [Staff Augmentation](https://www.ecg.co/services/staff-augmentation) - [IT Consulting & Engineering](https://www.ecg.co/services/it-consulting-and-engineering) #### Company - [About](https://www.ecg.co/about) - [Careers](https://www.ecg.co/careers) - [Blog](https://www.ecg.co/blog) - [Resources](https://www.ecg.co/resource-library) - [Events](https://www.ecg.co/events) © ECG, Inc. [Privacy Policy](https://9353907.hs-sites.com/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mark Lindsey", "url" : "https://www.ecg.co/blog/author/mark-lindsey" }, "dateModified" : "2025-03-31T08:16:56.301Z", "datePublished" : "2020-09-17T04:00:00.000Z", "headline" : "Defend the BroadWorks XSP from Device Management Scanning - ECG", "image" : [ "https://www.ecg.co/hubfs/Imported_Blog_Media/regular_dima-pechurin-JUbjYFvCv00-unsplash-1.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.ecg.co/blog/150-defend-the-broadworks-xsp-from-device-management-scanning-attacks", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.ecg.co/hubfs/ECG_hexagons_and_url_borderless.jpeg" }, "name" : "ECG, Inc" } } ```