 large num- ber of uncompleted transactions could eventually render the provided service unavailable. In addition, as highlighted by Sisalem, Kuthan, and Ehlert, a rather simple way to disrupt the operation of a SIP server is to employ a single source attack architectures and include irresolvable URIs in the SIP invitation messages [6]. Every time a SIP server attempts to parse such a message it has to wait for the reply of the DNS resolving the URI before com- pleting the operation. As a result, the combination of single source invitation attacks with unresolvable addresses could cause rapid resource consumption, disrupting the availability of the offered services. All the aforementioned sce- narios could lead to more severe attacks by utilizing multiple source flooding architectures, similar to those illustrated in Figure 18.6. © 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures It should be noticed that the aforementioned flooding attacks are similar to the well known TCP/SYN attack, mainly because of the similarities among the SIP and TCP handshake phases. In the TCP/SYN attack the attacker includes a spoofed destination address in a SYN message, mandating the server to reserve resources until the appropriate TCP timer expires [19]. A variation of the TCP/SYN attack appeared in January 2002. According to this attack, innocent TCP servers were exploited as amplifiers (also known as reflectors) to paralyze a specific server or even an entire network. In order to do that the attacker generates a large number of TCP/SYN requests including spoofed (with the victim's IP) IP addresses. Upon that, the innocent servers respond by generating the respective SYN/ACK messages that are forwarded to the victim. This type of attack is known as Reflection Distributed DoS (RDDoS) [20]. Normally, such an attack consumes all the available bandwidth or exhausts the target server's resources. Similar attacks may be launched against a SIP server or network. Specifi- cally, the attacker c