ues to identify SPIT invalid. E-mail spam is mainly textual and may be combined by images, video or sound. SPIT takes the form of audio, video and maybe some instant text messages. The cost of sending a SPIT call is higher that sending an e-mail, in terms of resources and it can cause overload on a network. The annoyance of the user is considered higher when he receives a call as opposed to receiving an e-mail. Thus, one has to carefully examine the applicability of existing countermeasures to the SIP environment. In order to design an anti-SPIT framework one needs to also identify the points where anti-SPIT countermeasures can be placed. These can firstly be applied on the domain of the SPITter (i.e., outgoing proxy server) and act proactively in the sense that the SPIT message or call does not leave the boundaries of the caller's domain. In addition, mechanisms can be deployed in the domain of the user that is the target of SPIT (i.e., incoming proxy server), which act reactively and aim at identifying an incoming SPIT call or message. When SPIT is detected, handling mechanisms can be applied, which C 2009 by Taylor & Francis Group, LLC SIP Vulnerabilities for SPIT, SPIT Identification Criteria may vary from flagging the call or message as potential SPIT to blocking it, depending on the domain's policies or the target's preferences. To identify the overall amount of SPIT risk when using SIP for voice ser- vices, a vulnerability analysis is crucial. This study will report which of the SIP protocol specifications are vulnerable, whenever these specifications are mandatory or optional, if the interoperability with other protocols produces flaws, and, finally, if generic security weaknesses can be used for SPIT attacks. This is considered essential since potential anti-SPIT mechanism should be aware of these vulnerabilities in order to mitigate their impact. Additionally, as several anti-SPIT mechanisms have recently been proposed in the literature, it is useful to survey their main functionality to identify metric