-
Notifications
You must be signed in to change notification settings - Fork 1
Limitations and FAQ
| Not handled | Consequence |
|---|---|
| SIP over TLS payloads | Encrypted SIP content cannot be classified. A source condemned by IP can still be dropped. |
| SIP over TCP detection | TCP application reassembly is not implemented. Enforcement of an already-condemned source covers configured TCP SIP ports. |
| IPv6 | Capture currently handles IPv4 only. IPv6 traffic is counted and warned about. |
| Behavioural enforcement | Experimental fraud verdicts are detected and reported, but not applied. |
| First 30 days | The behavioural layer learns and reports WOULD BLOCK; perimeter prevention stays active. |
| Low-and-slow imitation | An attacker closely matching a legitimate low-volume profile may not be distinguishable on the wire. |
| Broad international profiles | Novelty becomes less useful for peers already calling most countries. |
TFPS is one layer of SIP defense. It does not replace network segmentation, strong unique credentials, outbound permissions, softswitch rate limits, billing alarms, patch management, or an incident-response plan.
For the SIP attacks it recognizes, it performs the perimeter job earlier—from packets rather than delayed or incomplete logs. Keep other fail2ban jails protecting SSH, web applications, and services TFPS does not inspect.
No. The first unauthenticated REGISTER → 401 exchange is normal and ignored. A failed
authentication is a credential-bearing request rejected with another 401 or 407.
No. Capture uses AF_PACKET; TFPS does not bind the softswitch's UDP socket.
Yes. Run with --no-enforce. Do not use ignoreip: ["0.0.0.0/0"]; that configuration is
rejected so global observation cannot be mistaken for an exemption list.
No. It is opt-in, highly experimental, and does not enforce its verdict today. The default perimeter prevention layer is the production feature.