Applies To:
Show VersionsBIG-IP AFM
- 14.1.2, 14.1.0
Detecting and Preventing SIP DoS Attacks on a Protected Object
Overview: Detecting and preventing SIP DoS attacks on a protected object
Session Initiation Protocol (SIP) is a signaling protocol that is typically used to control communication sessions, such as voice and video calls over IP.
SIP DoS attack detection and prevention serves several functions:
- To detect and report on SIP packets based on behavior characteristics of the sender or characteristics of the packets, without enforcing any rate limits.
- To detect, report on, and rate limit SIP packets based on behavior characteristics that signify specific known attack vectors.
- To identify Bad Actor IP addresses from which attacks appear to originate, by detecting packets per second from a source, and to apply rate limits to such IP addresses.
- To blacklist Bad Actor IP addresses, with configurable detection times, blacklist durations, and blacklist categories, and allow such IP addresses to be advertised to edge routers to offload blacklisting.
You can use a SIP DoS protection profile to specify the percentage increase over the system baseline, which indicates that a possible attack is in process on a particular SIP method, or an increase in anomalous packets. You can also rate limit packets of known vectors. For all SIP vectors except sip-malformed, the system can manage thresholds automatically or manually. You can manually set thresholds for malformed SIP packets.
You can specify an address list as a whitelist, that the DoS checks allow. Whitelisted addresses are not subject to the checks configured in the protection profile.
To guard a protected object from SIP DoS attacks, you need to associate the protected object with a protection profile that includes SIP security.