each time it receives a retransmission of the INVITE. Timer A and Timer B work as shown before. The INVITE flooding attack means the intruder lunches INVITE flooding to overwhelm a single proxy server within a short period of time and causes DoS. We edit only a SIP agent and a SIP proxy server for our simulation. In order to simplify the procedure, the time for retransmission C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security of INVITE is shortened by changing the value of the parameter for resched() function with an Invitetimer object inv_tmr, which is initialized as 0.5 S. The intruder ignores the "100 Trying" response to simulate INVITE flooding by deleting the code to close the timer for retransmission when sh type is of SIP_RSP_TRYING type. We can even develop a mechanism for detection of this attack. A normal SIP Agent A sends INVITE to SIP proxy server, if the SIP proxy server suffers INVITE flooding, the queue to deal with INVITE is too long to deal with the request of A. So, A is always in timeout status. What's more, by testing the number of INVITE messages the server received in a short period in trace file, we may know about the time the attack starts. 16.4.2 Other Simulators Supporting SIP 16.4.2.1 OPNET and QualNet Besides NS-2, there are also some powerful network simulators supporting the SIP module, especially OPNET and QualNet, which are popular within academia, commercial, and industrial communities. OPNET, the primary product of MIL3 Inc. provides a comprehensive devel- opment environment for the specification, simulation, and performance anal- ysis of communication networks, computer systems and applications, and distributed systems [17]. OPNET provides a SIP model for VoIP, which con- tains SIP, RTP and H.323 to allow VoIP simulations based on the standard model library of OPNET Modeler. There are also SIP agent modules such as proxy server and UAC modules that contribute the topology of SIP simulation scenarios. Before simulation, the attributes of them