As the deployment of Session Initiation Protocol (SIP) accelerates
of a firewall in protecting the IP Multimedia Subsystem (IMS) or SIP-based core network, distinguish it from an SBC, and characterize the specific threats to SIP messages at the L2 (data link layer), L3 (network layer), L4 (transport layer), and L5 (session layer).We show how a SIP firewall can thwart these attacks and we propose an implementation based on a simplified, but fully hardware accelerated SIP proxy as a front end SIP firewall. Such a system naturally blocks most attacks and implements many defense mechanisms. © 2011 Alcatel-Lucent. make sense of the SIP message and qualify it as normal or anomalous. Clearly, burdening a conventional firewall with these capabilities while also expecting that it will perform its canonical firewall duties is a difficult undertaking. In order to deal with SIP-specific attacks, a SIP firewall must have enough knowledge of SIP grammar to allow some parsing, and enough cognizance of SIP state to be state-aware in order to stop the large variety of attacks that are possible.