[VoiceOps] Mitigating or stopping TDOS attacks - any advice?

[Ivan Kovacevic]

For us, the bigger problem is the ‘what to do’ rather than ‘how to’.



I’ve struggled with putting together meaningful and effective requirements
for TDOS. There are a few companies that sell ‘voice firewalls’ but their
materials are heavy on marketing-speak and “we enable you to do this and
that”, rather than “This is what we do and how we do it”.



In my view, the main problem with TDOS is to identify it and be able to
differentiate between TDOS calls and regular call volume.



It seems to be more of an art, making it inherently difficult to
programmatically pre-empt it.



Best Regards,



Ivan Kovacevic

Vice President, Client Services

Star Telecom | www.startelecom.ca
<http://t.sidekickopen61.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XYg1qMvVnW3LjyBM63K6FlW63JXmj56dLPjf6TyZWx02?t=http%3A%2F%2Fwww.startelecom.ca%2F&si=6470560385859584&pi=46813559-c184-4aa3-a9f0-b4d5979660e8>
| SIP Based Services for Contact Centers | LinkedIn
<http://t.sidekickopen61.com/e1t/c/5/f18dQhb0S7lC8dDMPbW2n0x6l2B9nMJW7t5XYg1qMvVnW3LjyBM63K6FlW63JXmj56dLPjf6TyZWx02?t=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fstar-telecom-www-startelecom-ca-%3Ftrk%3Dbiz-companies-cym&si=6470560385859584&pi=46813559-c184-4aa3-a9f0-b4d5979660e8>



*From:* VoiceOps [mailto:voiceops-bounces at voiceops.org] *On Behalf Of *Victor
Chukalovskiy
*Sent:* May 15, 2017 11:06 AM
*To:* Matthew Yaklin <myaklin at firstlight.net>; voiceops at voiceops.org
*Subject:* Re: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?



Hi,



You are talking PSTN --> customer call flow scenario in CLEC setting.
Usually  a class 4/5 switch is set to "transparently" pass all incoming
calls from PSTN side to whatever customers trunk or line the DID or range
is pointed to. And then either that resource gets full due to call volume
or your switch starts failing or lagging due to CPS.



You have two options however:



If you were to pass all your traffic through a SIP proxy, like Kamallio or
OpenSIPS like Alex suggested, that  proxy can be programmed to do any kind
of fancy call admissions control, dynamic filtering, number pattern etc.‎
This however means you put an extra box in the call path between your PSTN
switch and a customer.



Alternatively, you may try to see if all your PSTN switches can do some
kind of external dip or routing query on incoming calls (radius, SIP refer
etc). If they can, you can set a server or a cluster that would answer all
those dips and decide on per-call basis wether the call should be admitted
or not. So think external "brain" for your switches. This way call
admission controll decision is made externally, but enforced right at your
PSTN switch, and you don't have extra box in the call path. Making it
somewhat more elegant.



This is pretty high-level, but if I understood your topology right, these
are basically your two options.



-Victor



Sent from my BlackBerry 10 smartphone.

*From: *Matthew Yaklin

*Sent: *Monday, May 15, 2017 10:44

*To: *voiceops at voiceops.org

*Subject: *[VoiceOps] Mitigating or stopping TDOS attacks - any advice?



Hello all,



I am curious what others have in place or actions they take when a customer
is the target of a TDOS attack?

TDOS being Telephony Denial of Service. An attack where the perp uses
whatever means to flood a customer's telephone service with unwanted calls.



Say you are a multi state CLEC. You have multiple brands of switches (Meta,
Taqua, DMS, Genband, etc...) as well as ACME and Perimeta SBCs in use. You
have legacy TDM as well as SIP trunks. Your customers are served via legacy
and modern methods. You have hosted PBX as well (Broadsoft). Many customers
are on your LAN but many are on the internet. So that is our situation. Or
you can be bigger or smaller. No matter the size I would welcome how you
handle it.



We have asked our manufacturers for advice but they have only provided the
basic number blocking available by default on the switch. Meta and Genband
have provided little other than pointing to existing features. If you have
any thoughts on whether there is something we can provide based upon SIP
messaging or other creative solutions that would be awesome!



So I welcome a discussion on this and any advice other operators can give.



Thank you very much,



Matt







[image:
http://t.sidekickopen61.com/e1t/o/5/f18dQhb0S7ks8dDMPbW2n0x6l2B9gXrN7sKj6v4LCS0Vf6xNj7dSCJWW64Jplz1pctGFW55kbNc1k1H6H0?si=6470560385859584&pi=46813559-c184-4aa3-a9f0-b4d5979660e8]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/voiceops/attachments/20170515/e156e177/attachment.html>