VoIP security
A network switch automatically detects Voice over Internet Protocol (VoIP) traffic and mirrors the VoIP traffic to a security management device. The security management device measures a rate of call setup packets in the VoIP traffic. The security management device detects an attack based on a comparison of the measured rate of call setup packets to a threshold rate. Detected attacks are mitigated.
1. A method in a network switch, the method comprising:
detecting Voice over Internet Protocol (VoIP) traffic at the network switch;
measuring a rate of call setup packets in the VoIP traffic;
detecting that a threshold is exceeded by the measured rate;
in response to the detecting that the threshold is exceeded:
mirroring the call setup packets in the VoIP traffic to create a copy of the call setup packets;
sending the call setup packets from the network switch to one of a security management device and one or more destination network nodes; and
sending the copy of the call setup packets from the network switch to the other of the security management device and the one or more destination network nodes, wherein the security management device performs an analysis of received call setup packets; and
responsive to the analysis, receiving at the network switch instructions from the separate security management device, the instructions for mitigating a security threat.
2. The method of claim 1 , wherein detecting VoIP traffic comprises detecting Transmission Control Protocol (TCP) traffic having a destination port number that matches a designated VoIP traffic port number.
3. The method of claim 1 , wherein receiving the instructions comprises receiving a dynamically generated policy from the security management device, the policy directing the network switch to block and/or ignore the call setup packets in the VoIP traffic the method further comprising:
implementing in real-time, the dynamically generated policy from the security management device.
4. The method of claim 1 , wherein detecting VoIP traffic comprises detecting Universal Datagram Protocol (UDP) traffic having a destination port number that matches a designated VoIP traffic port number.
5. The method of claim 4 , wherein measuring the rate of call setup packets in the VoIP traffic comprises measuring a number of VoIP sessions initiated via International Telecommunications Union (ITU) H.323 compatible call setup requests or measuring a number of Internet Engineering Task Force (IETF) Session Initiation Protocol (SIP) compatible call set up requests, or both.
6. The method of claim 1 , further comprising determining whether VoIP traffic originates from a valid VoIP handset.
7. The method of claim 6 , wherein the valid VoIP handset is identified based on a valid Internet Protocol (IP) address and a valid Media Access Control (MAC) address.
8. The method of claim 1 , wherein mitigating the threat comprises at least one of blocking traffic associated with the threat and redirecting traffic from the source of the threat.
9. A system, comprising:
a network switch to automatically detect Voice over Internet Protocol (VoIP) traffic;
a security management device communicatively interfaced with the network switch via a network;
wherein the network switch to further:
measure a rate of original call setup packets in the VoIP traffic,
detect that a threshold is exceeded by the measured rate, and
in response to the detecting that the threshold is exceeded:
mirror the original call setup packets in the VoIP traffic to create a copy of the original call setup packets,
send the original call setup packets from the network switch to one of the security management device and one or more destination network nodes, and
send the copy of the original call setup packets from the network switch to the other of the security management device and the one or more destination network nodes; and
wherein the security management device to perform an analysis of the call setup packets sent from the network switch to the security management device, and send to the network switch instructions generated based on the analysis, the instructions to mitigate a security threat.
10. The system of claim 9 , wherein the security management device to further:
determine a source of the threat, including generating a model of a communication stream between the source of the threat and an intended destination of the threat; and
redirect traffic sent from the source of the threat.
11. The system of claim 9 , where the security management device is virtually in-line within the network and not physically in-line with the network, and wherein only copies of call setup packets in VoIP traffic suspected to contain a threat are passed to the security management device, with all other traffic bypassing the security management device.
12. The system of claim 10 , wherein the security management device to redirect traffic sent from the source of the threat comprises the security management device to redirect the traffic based at least in part on one or more of access control lists (ACL(s)), policy-based routing, virtual local area network (VLAN) identifications (IDs), Hypertext Transfer Protocol (HTTP) information, or Extensible Markup Language (XML) tags.
13. A non-transitory machine-readable storage medium having instructions stored thereon that, when executed by a network switch, cause the network switch to perform a method comprising:
detecting Voice over Internet Protocol (VoIP) traffic at the network switch;
measuring a rate of call setup packets in the VoIP traffic;
detecting that a threshold is exceeded by the measured rate; in response to the detecting that the threshold is exceeded:
mirroring the call setup packets in the VoIP traffic to create a copy of the call setup packets;
sending the call setup packets from the network switch to one of a security management device and one or more destination network nodes; and
sending the copy of the call setup packets from the network switch to the other of the security management device and the one or more destination network nodes, wherein the security management device performs an analysis of received call setup packets; and
responsive to the analysis, receiving at the network switch instructions from the separate security management device, the instructions for mitigating a security threat.
14. The non-transitory machine-readable storage medium of claim 13 , wherein detecting VoIP traffic comprises detecting Transmission Control Protocol (TCP) traffic having a destination port number that matches a designated VoIP traffic port number.
15. The non-transitory machine-readable storage medium of claim 13 , wherein receiving the instructions comprises receiving a dynamically generated policy from the security management device, the policy directing the network switch to block and/or ignore the call setup packets in the VoIP traffic , the method further comprising:
implementing in real-time, the dynamically generated policy from the security management device.
16. The non-transitory machine-readable storage medium of claim 13 , wherein detecting VoIP traffic comprises detecting Universal Datagram Protocol (UDP) traffic having a destination port number that matches a designated VoIP traffic port number.
17. The non-transitory machine-readable storage medium of claim 16 , wherein measuring the rate of call setup packets in the VoIP traffic comprises measuring a number of VoIP sessions initiated via International Telecommunications Union (ITU) H.323 compatible call setup requests or measuring a number of Internet Engineering Task Force (IETF) Session Initiation Protocol (SIP) compatible call set up requests, or both.
18. The machine-readable storage medium of claim 13 , wherein the method further comprises determining whether VoIP traffic originates from a valid VoIP handset.
19. The non-transitory machine-readable storage medium of claim 18 , wherein the valid VoIP handset is identified based on a valid Internet Protocol (IP) address and a valid Media Access Control (MAC) address.
20. The non-transitory machine-readable storage medium of claim 13 , wherein mitigating the attack comprises at least one of blocking traffic associated with the threat and redirecting traffic from the source of the threat.