 they send it to the proxy of their own domain which then authenticates the user through the digest mechanism. This mode is SO common that it may as well be called the standard mode of operation. The SIP specification calls it the SIP trapezoid. This can be exploited for detection of SPIT. If an INVITE is received from a host that is not known to be a proxy of the domain of the caller, it is more likely to be SPIT and should be tested further. The Via header provides a list of all hosts that the request has traversed SO far. Since it is used to route a response back, the addresses in the Via cannot be tampered with or the response will never arrive. Although, in order to successfully establish a call, this response has to arrive. A simple version of the test for an outgoing proxy is to merely count the number of Via values present. If the request passed through a proxy, there will C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security be at least two. Of course a SPITter (to differentiate from someone spewing saliva or tobacco juice) can easily deal with this by simply adding a second Via. On the other hand, many operators use SBCs or B2BUAs which by storing the path a response has to take internally and are able to remove the Via list. Therefore, the test has to check the IP addresses given in the Via list. In most cases, comparing them with the addresses returned by the standard procedure for finding the SIP proxies for the domain is sufficient. However, some operators use different addresses for outgoing proxies SO that the last hop may not be in this list of addresses. Comparing earlier entries in the Via list does not work reliably either, since it is possible to add additional entries in that list before the entry that will lead the response to the originating host. The proxy check module can be more efficient if a list reporting available open relay proxies is built. So, any suspicious information present in the SIP message header of the intercepted SIP request can be chec