SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks.
A freeswitch server I manage has seen heaps of registration requests on UDP (~300/second), each one generating a 401 unauthorized response. We only caught these when performance issues led me to do a dump on the wire and investigate the traffic.
Being UDP traffic, blocking it in iptables has a limited effect. The incoming traffic still wastes bandwidth, but the SIP server doesn't have to respond to it and the reply traffic isn't generated.
Because it's UDP, it's probably being spoofed. The real victim is probably the "source", which is being bombarded with my 401 messages.
This kind of problem must be very common. Is there a current best practice for hosting SIP services so that they aren't valuable to attackers as sources for reflection attacks?
Thanks for any insights.
Update: 24 hours after blocking the inbound SIP traffic, it stopped.