tion of UDP and other security mechanisms (IPSec/UDP and DTLS/UDP). How- ever, there is no congestion control involved with SIP over IPSec/UDP or DTLS/UDP. A high level of congestion increases the call setup delay with TLS/TCP. At low network congestion there is no significant difference between the call setup times for the combinations of IPSec/TCP and TLS/TCP. In general the overhead associated with message authentication is very small when TLS and IPSec are involved. 22.3 SIP Security SIP security threats fall into one of four different categories. The first set of threats result from the vulnerabilities of the SIP protocol. These threats C 2009 by Taylor & Francis Group, LLC SIP Security and Quality of Service Performance take advantage of the flaws in the definition of SIP in terms of its charac- teristics, functionality and description. The second set of threats result from its interoperation with other protocols. This relates to SIP interfacing with other protocols. The third group is threats that exploit the operational details of SIP including mandatory, non-mandatory and/or optional requirements of SIP. The fourth type of threat result from the inherent security risks associ- ated with the system under which SIP is used. These four categories of threats are discussed well elsewhere [13]. SPam over Internet Telephony (SPIT) is emerging as a major security prob- lem brought to the fore because of the reduced cost of VoIP services compared with the traditional voice calls over PSTN. The deterrent posed by the high cost of voice calls over PSTN has been removed and in doing SO a new prob- lem has emerged (SPIT) or has it? From experience, there is no significant spam through short messaging service (SMS) which suggests that SPIT may not be as major a problem as anticipated. SPIT consists of two components which are signaling and media. Three different forms of SPIT can be identified. These are (a) Voice or call SPIT. Call SPIT is defined as 'a bulk unsolicited set of ses- sion initiation attempts in order t