<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>Do you know off hand what criteria Kamailio commonly uses to dump excessive SIP flows?</p>
<p>Is it based on IP (black/whitelists)? Throttling back INVITES from the same source? </p>
<p><br>
</p>
<p>A common method that was in the news was someone posting a malicious link on twitter (for example) that caused cell phones to dial 911. If the twitter feed is read by folks who live in Massachusetts for example the 911 call center could be flooded for a
period of time. Just an example. </p>
<p><br>
</p>
<p>Is this another case, like DDOS, where we are just screwed for the most part as providers?</p>
<p><br>
</p>
<p>Matt</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> sasha@evaristesys.com <sasha@evaristesys.com> on behalf of Alex Balashov <abalashov@evaristesys.com><br>
<b>Sent:</b> Monday, May 15, 2017 10:49:29 AM<br>
<b>To:</b> Matthew Yaklin<br>
<b>Cc:</b> voiceops@voiceops.org<br>
<b>Subject:</b> Re: [VoiceOps] Mitigating or stopping TDOS attacks - any advice?</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">In the open-source world, this is an application to which Kamailio is<br>
exceptionally well-suited, provided you can devise some means of putting<br>
the customer "behind" it.<br>
<br>
The lightweight architecture and enormous message throughput makes it an<br>
exceptionally good fit for lightly stateful tasks like dumping excessive<br>
SIP flows.<br>
<br>
On Mon, May 15, 2017 at 02:44:30PM +0000, Matthew Yaklin wrote:<br>
<br>
> Hello all,<br>
> <br>
> <br>
> I am curious what others have in place or actions they take when a customer is the target of a TDOS attack?<br>
> <br>
> TDOS being Telephony Denial of Service. An attack where the perp uses whatever means to flood a customer's telephone service with unwanted calls.<br>
> <br>
> <br>
> Say you are a multi state CLEC. You have multiple brands of switches (Meta, Taqua, DMS, Genband, etc...) as well as ACME and Perimeta SBCs in use. You have legacy TDM as well as SIP trunks. Your customers are served via legacy and modern methods. You have
hosted PBX as well (Broadsoft). Many customers are on your LAN but many are on the internet. So that is our situation. Or you can be bigger or smaller. No matter the size I would welcome how you handle it.<br>
> <br>
> <br>
> We have asked our manufacturers for advice but they have only provided the basic number blocking available by default on the switch. Meta and Genband have provided little other than pointing to existing features. If you have any thoughts on whether there
is something we can provide based upon SIP messaging or other creative solutions that would be awesome!<br>
> <br>
> <br>
> So I welcome a discussion on this and any advice other operators can give.<br>
> <br>
> <br>
> Thank you very much,<br>
> <br>
> <br>
> Matt<br>
> <br>
> <br>
<br>
> _______________________________________________<br>
> VoiceOps mailing list<br>
> VoiceOps@voiceops.org<br>
> <a href="https://puck.nether.net/mailman/listinfo/voiceops">https://puck.nether.net/mailman/listinfo/voiceops</a><br>
<br>
<br>
-- <br>
Alex Balashov | Principal | Evariste Systems LLC<br>
<br>
Tel: +1-706-510-6800 / +1-800-250-5920 (toll-free) <br>
Web: <a href="http://www.evaristesys.com/">http://www.evaristesys.com/</a>, <a href="http://www.csrpswitch.com/">
http://www.csrpswitch.com/</a><br>
</div>
</span></font>
</body>
</html>