ts may also inspect the 'Via' header chain in order to double-check whether or not TLS was used for the entire request path until the local administrative domain was reached. S/MIME may also be used by the originating UAC to help ensure that the original form of the 'To' header field is carried end-to-end. If the UAS has reason to believe that the scheme of the Request-URI has been improperly modified in transit, the UA should notify its user of a poten- tial security breach. As a further measure to prevent downgrade attacks, entities that accept only SIP requests may also refuse connections on insecure ports. End users will undoubtedly discern the difference between SIP and SIP URIs, and they may manually edit them in response to stimuli. This can either benefit or degrade security. For example, if an attacker corrupts a DNS cache, inserting C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security TABLE 22.10 Experimental Results (Threads and Throughput) Active threads Single thread throughput (s-1) Total throughput (s-1) Source: From Salsano, S., Veltri, L., and Papalilo, D. SIP security issues: The SIP authentication procedure and its processing load. Network IEEE, 16(6), 38-44, November/December 2002. With permission. a fake record set that effectively removes all SIP records for a proxy server, then any SIP requests that traverse this proxy server may fail. When a user, however, sees that repeated calls to a SIP AOR are failing, they could on some devices manually convert the scheme from SIP to SIP and retry. Of course, there are some safeguards against this (if the destination UA is truly paranoid it could refuse all non-SIP requests), but it is a limitation worth noting. On the bright side, users might also divine that SIP would be valid even when they are presented only with a SIP URI [20]. 22.3.4.3 SIP Processing Cost Starting from the SIP-based telephony service scenario, eight procedures/ scenarios have been identified to compare their processing costs [21]. As reported,