ses straight text encoding in its messages (unlike H.323 that uses ASN.1 encoding). This makes SIP an easy target for hackers. Many of the protocol attacks can be launched against H.323 as well, but very few incidents of this were in the industry because H.323 is not as accessible as SIP. Several ways to protect your network against a variety of SIP protocol attacks include Setting the SIP listening port Using TLS for authentication Using a border element B2BUA 120 SIP Trunking Using SIP normalization techniques to suppress or overwrite information in the SIP message such as the calling phone numbers, hostnames, or descriptive tags before a call enters the public network Using digit manipulation techniques to suppress or overwrite phone numbers before a call enters the public network Using SIP privacy settings to communicate the information within the SIP message that might or might not be used Each of these areas is discussed in the following sections. SIP Listening Port Every Internet hacker knows the default SIP listen ports and can sweep them from any Internet location to find an open port to launch fraudulent calls, all while your business pays for them. One way to protect against this is to change the SIP listening port to a nondefault setting. It requires the service provider to set the complementary port on the provider edge SBC. This alone can protect you against the majority of hacker attacks launched against SIP port 5060. Example 7-2 shows the commands needed to set the SIP listening port to a nondefault setting. Example 7-2 SIP Listening Port Setting voice service voip shutdown voice service voip listen-port non n-secure 2000 secure 2050 voice service voip no shutdown Transport Layer Security (TLS) Another way to protect against this attack is to use TLS (specified in IETF RFC-2246). TLS uses an authentication mechanism that ensures only valid endpoints connect to your SIP trunk, and if the authentication fails, the call is refused. Although this is a good way to mitigate fraudulent SIP calls, none o