[VoiceOps] Mitigating or stopping TDOS attacks - any advice?

[Alex Balashov]

In the open-source world, this is an application to which Kamailio is
exceptionally well-suited, provided you can devise some means of putting
the customer "behind" it.

The lightweight architecture and enormous message throughput makes it an
exceptionally good fit for lightly stateful tasks like dumping excessive
SIP flows.

On Mon, May 15, 2017 at 02:44:30PM +0000, Matthew Yaklin wrote:

> Hello all,
> 
> 
> I am curious what others have in place or actions they take when a customer is the target of a TDOS attack?
> 
> TDOS being Telephony Denial of Service. An attack where the perp uses whatever means to flood a customer's telephone service with unwanted calls.
> 
> 
> Say you are a multi state CLEC. You have multiple brands of switches (Meta, Taqua, DMS, Genband, etc...) as well as ACME and Perimeta SBCs in use. You have legacy TDM as well as SIP trunks. Your customers are served via legacy and modern methods. You have hosted PBX as well (Broadsoft). Many customers are on your LAN but many are on the internet. So that is our situation. Or you can be bigger or smaller. No matter the size I would welcome how you handle it.
> 
> 
> We have asked our manufacturers for advice but they have only provided the basic number blocking available by default on the switch. Meta and Genband have provided little other than pointing to existing features. If you have any thoughts on whether there is something we can provide based upon SIP messaging or other creative solutions that would be awesome!
> 
> 
> So I welcome a discussion on this and any advice other operators can give.
> 
> 
> Thank you very much,
> 
> 
> Matt
> 
> 

> _______________________________________________
> VoiceOps mailing list
> VoiceOps at voiceops.org
> https://puck.nether.net/mailman/listinfo/voiceops


-- 
Alex Balashov | Principal | Evariste Systems LLC

Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) 
Web: http://www.evaristesys.com/, http://www.csrpswitch.com/