User's Manual 168 Document #: LTRT-27045
Mediant 1000B Gateway & E-SBC
Block (blacklist) remote hosts (IP addresses / ports) considered by the device as
malicious. The device automatically blacklists the malicious source for a user-defined
period after which it is removed from the blacklist.
Send SNMP traps to notify of malicious activity and/or whether an attacker has been
added to or removed from the blacklist. For more information, see ''Viewing IDS
Alarms'' on page
175.
The Intrusion Detection System (IDS) is an important feature for Enterprises to ensure
legitimate calls are not being adversely affected by attacks and to prevent Theft of Service
and unauthorized access.
There are many types of malicious attacks, the most common being:
Denial of service: This can be Denial of Service (DoS) where an attacker wishing to
prevent a server from functioning correctly directs a large amount of requests –
sometimes meaningless and sometimes legitimate, or it can be Distributed Denial of
Service (DDoS) where the attacker controls a large group of systems to coordinate a
large scale DoS attack against a system:
• Message payload tampering: Attacker may inject harmful content into a message,
e.g., by entering meaningless or wrong information, with the goal of exploiting a
buffer overflow at the target. Such messages can be used to probe for
vulnerabilities at the target.
• Message flow tampering: This is a special case of DoS attacks. These attacks
disturb the ongoing communication between users. An attacker can then target
the connection by injecting fake signaling messages into the communication
channel (such as CANCEL messages).
• Message Flooding: The most common DoS attack is where an attacker sends a
huge amount of messages (e.g., INVITEs) to a target. The goal is to overwhelm
the target’s processing capabilities, thereby rendering the target inoperable.
SPAM over Internet Telephony (SPIT): VoIP spam is unwanted, automatically
dialed, pre-recorded phone calls using VoIP. It is similar to e-mail spam.
Theft of Service (ToS): Service theft can be exemplified by phreaking, which is a type
of hacking that steals service (i.e., free calls) from a service provider, or uses a service
while passing the cost to another person.
The IDS configuration is based on IDS Policies, where each policy can be configured with
a set of IDS rules. Each rule defines a type of malicious attack to detect and the number of
attacks during an interval (threshold) before an SNMP trap is sent. Each policy is then
applied to a target under attack (SIP interface) and/or source of attack (Proxy Set and/or
subnet address).
13.3.1 Enabling IDS
The following procedure describes how to enable IDS.
To enable IDS:
1. Open the IDS General Settings page (Setup menu > Signaling & Media tab >
Intrusion Detection folder >IDS General Settings).
Figure 13-3: Enabling IDS
2. From the 'Intrusion Detection System' drop-down list, select Enable.
3. Click Apply, and then reset the device with a save-to-flash for the setting to take
To Next Page
Need help?
General
