My wife and I will celebrate our 18th wedding anniversary next month, and while I have many good memories from our wedding, I also have one regret.
In the months leading up to the wedding, we invested a lot of time into planning the reception, especially the food. We taste-tested menus, researched caterers, and selected a fantastic meal to celebrate with our family and friends.
And then the big day arrived.
And… we barely ate.
Between well-wishers, group photos, and heartfelt toasts, we hardly sat down long enough to pick at the starters, let alone enjoy the entrees. Despite all the preparation, we were too overwhelmed by everything else to do the one thing we had planned so carefully: eat.
This, oddly enough, is a pretty good analogy for a Denial of Service (DoS) attack.
The Feast Denied: Understanding DoS in SIP Networks
Just as we were unable to eat due to the sheer volume of interactions at our reception, a network under DoS attack is unable to fulfill its core responsibilities because it’s too busy handling a flood of incoming requests. Whether malicious or accidental, this overload of traffic prevents legitimate users from receiving service.
In SIP networks, this is especially problematic. SIP infrastructure like softswitches and application servers often assume that upstream signaling has already been vetted. Without proper protection, these core components can be overwhelmed by excessive call attempts, malformed messages, or repeated registration attempts from misbehaving endpoints.
Enter the Session Border Controller: Your Network’s Bouncer
In our previous article we focused on an overall “Swiss Cheese” approach to security, but today we’re going to focus on the role played by the Metaswitch/Alianza Perimeta SBC and understanding how its blacklisting function can help protect your network.
An SBC sits at the edge of your network, where it serves as both a gatekeeper and a bodyguard.
Key functions of the Perimeta SBC include:
- Topology hiding to obscure your internal network structure.
- Media and signaling encryption using TLS, SRTP, and IPsec.
- Interface trust levels that distinguish between trusted peers and untrusted public networks.
- Capacity control, which sets hard limits on the traffic passed through to core infrastructure.
- Blacklisting, both static and dynamic, to automatically block bad actors.
Let’s dig into blacklisting a bit more.
Dynamic Blacklisting: Intelligent Defense on the Front Line
Static blacklisting lets you manually ban known IPs—perhaps entire regions with a history of VoIP fraud. But the real power lies in Perimeta’s dynamic blacklisting, which uses thresholds and traffic patterns to automatically identify and shut down suspicious sources.
This is managed through a “leaky bucket” algorithm. In simple terms, each IP gets a bucket. Suspect packets fill the bucket; clean behavior lets it drain. If the bucket overflows—for reasons like excessive SIP REGISTER attempts, malformed SIP messages, or brute force authentication failures—Perimeta can trigger alarms, downgrade trust, or ban the IP entirely.
Because this happens at a low level in the SBC, offending packets are dropped before they can clog up your core systems. Think of it as your bouncer intercepting troublemakers at the door, so the party inside can continue uninterrupted.
When You Need Extra Muscle: Beyond the SBC
While Perimeta provides excellent first-line defense, sometimes you need a little more. Distributed Denial of Service (DDoS) attacks, for example, can involve spoofed IPs or huge botnets that are hard to detect and block at the SBC alone.
In these cases, consider augmenting your defense with:
- Cloud-based DDoS protection services that scrub traffic before it reaches your perimeter.
- Dedicated network security appliances positioned upstream.
- Firewall rules and geo-blocking to reduce your attack surface.
Metaswitch’s own best practices guide emphasizes a layered security model—where the SBC is essential, but not the only line of defense.
Conclusion: Keep the Feast Going
If your VoIP network is your wedding reception, then the Perimeta SBC is the security detail ensuring that invited guests get in, troublemakers stay out, and you get to enjoy the feast. But just like a major event might also need venue security and police coordination, securing a SIP network often requires tools working in harmony.
If you’re not sure whether your current setup is secure enough, or if you’d like help configuring dynamic blacklisting effectively, we’d love to help.
Reach out — and make sure you don’t miss your own dinner.
