Dynamic blacklisting is a feature that detects abnormal events from endpoints and blocks the traffic from those endpoints for a configured period of time. This feature is designed to detect misbehaving endpoints rather than prevent malicious attacks, for which the system already has other mechanisms. The DBL events and the actions to take for each event are configured by the user in a DBL profile with a set of DBL rules. The DBL profile is then assigned to a SIP trunk group. Any packets that come in to the system from that trunk group will be compared against the DBL rules configured in that DBL profile.

 

Additional topics:

  • No labels