Brute-force intrusion attempts are quite common and VoIP PBX systems that are not protected are very susceptible to this type of attack. The most common consequence of this type of network attack can be:

• VOIP service interruption and unavailability,
• The possibility of password theft (SIP registration).

SIPProt automatically blocks IP addresses in the dynamic blacklist, then automatically unblocks after the time set in the parameter block_time of the file: /home/sipprot.conf

Then depending on the setting block_threshold It permanently blocks the IP address if it has been blocked more times than this value (for example, if the value is 3, the fourth block is permanent). The value can be set to 0, in which case it will never block permanently.

There are also the settings monit_period and hit_count to take into account.

example: monit_period = 60 and hit_count = 5

If during 60 seconds ago 5 sip registrations that have failed, sipPROT puts the IP address in the dynamic blacklist.