VoIP SIP Header Analyzer, RTP Bandwidth & SS7 Risk Simulator (2026)

In baseline RFC 3261 SIP, the `From:` header (`From: "Bank Fraud Dept" <sip:18005550199@spoof.example>`) and `P-Asserted-Identity` (PAI) are plain-text fields. If an upstream wholesale SIP trunk does not enforce strict ANI validation or strip untrusted PAI headers, an attacker's PBX can assert any telephone number.

The originating carrier signs a JSON Web Token called a PASSporT inside the SIP `Identity:` header using its STI-CA X.509 private key. The payload binds the calling number (`orig`), called number (`dest`), timestamp (`iat`), and Attestation Level: 'A' (Full: carrier knows the customer and their right to use the number), 'B' (Partial: customer known, number unverified), or 'C' (Gateway: international/legacy transit dump).

At standard 20ms packetization (50 packets per second), each packet carries 160 bytes of G.711 audio payload plus 12 bytes of RTP header, 8 bytes of UDP header, 20 bytes of IPv4 header, and 18 bytes of Ethernet L2 framing (58 bytes of header overhead per packet). Multiply 218 total bytes × 8 bits × 50 pps = 87.2 kbps per call.

Signaling System 7 (SS7) was built in the 1970s on implicit trust between global telecom operators. An attacker with leased access to an SS7 global title sends a fake `UpdateLocation` (UL) message to the victim's Home Location Register (HLR), claiming the victim is roaming on the attacker's MSC/VLR node. Subsequent `MT-ForwardSM` SMS messages are routed straight to the attacker.

Standard SDP media (`m=audio ... RTP/AVP`) transmits voice streams in cleartext UDP, allowing anyone with a packet sniffer (Wireshark) to replay calls with one click. Enforce TLS 1.3 for SIP signaling (SIPS on port 5061) and SRTP (`RTP/SAVP` with SDES or DTLS-SRTP) for AES-encrypted audio transport.