AudioCodes Mediant 4000 SBC User Manual page 402

as robustness testing), which sends different types of packets to its "victims" for finding
bugs and vulnerabilities. For example, the attacker might try sending a SIP message
containing either an oversized parameter or too many occurrences of a parameter.
You can also enable the Message Policy to protect the device against incoming SIP
messages with malicious signature patterns, which identify specific scanning tools used by
attackers to search for SIP servers in a network. To configure Malicious Signatures, see
''Configuring Malicious Signatures'' on page 559.
Each Message Policy rule can be configured with the following:

Maximum message length

Maximum header length

Maximum message body length

Maximum number of headers

Maximum number of bodies

Option to send 400 "Bad Request" response if message request is rejected

Blacklist and whitelist for defined methods (e.g., INVITE)

Blacklist and whitelist for defined bodies

Malicious Signatures
The Message Policies table provides a default Message Policy called "Malicious Signature
DB Protection" (Index 0), which is based only on Malicious Signatures and discards SIP
messages identified with any of the signature patterns configured in the Malicious
Signature table.
To apply a SIP Message Policy rule to calls, you need to assign it to the SIP Interface
associated with the relevant IP Group (see ''Configuring SIP Interfaces'' on page 341).
The following procedure describes how to configure Message Policy rules through the Web
interface. You can also configure it through ini file (MessagePolicy) or CLI (configure voip >
message message-policy).

To configure SIP Message Policy rules:
1. Open the Message Policies table (Setup menu > Signaling & Media tab > Message
Manipulation folder > Message Policies).
User's Manual 402
Mediant 4000 SBC
Document #: LTRT-40203