IPS Inbound SIP Trying blocked

Hello Thomas,

Thank you for contacting the Sophos Community.

According to the Snort documentation, this event is generated when an attempt is made to send a Malformed communication to a VoIP device.

So probably the packet that the device is sending might be corrupted.

https://www.snort.org/rule_docs/1-12074

https://www.3cx.com/pbx/sip-responses/

Regards,

Hello

doesnt this depend on if there is an preceding SIP invite message? SIP invite and trying messages are essential.

This seems to be related:

community.sophos.com/.../ips-service-seems-to-block-incoming-sip-calls---sfos-18-0-0-eap3

btw Why the rule is called inbound when the traffic is outbound?

Hello Thomas,

I would think so, however, the XG will only alert you of the incorrect packet.

If you do a tcpdump, on the XG you could see if you see more packets, or if this is the initial one.

Regards,

The action in the IPS is block and that is what i remember seeing on the traffic. Because of that i made an custom IPS rule with exclution of SID 20404. I dont see anything dangerous on SIP trying messages.

The action in the IPS is block and that is what i remember seeing on the traffic. Because of that i made an custom IPS rule with exclution of SID 20404. I dont see anything dangerous on SIP trying messages.