Forum Discussion
Evelin_195902
Sep 17, 2015Nimbostratus
Thanks Syed, It's a bit more complicated because we may have valid SIP request without any meeting number: like sip: or sip:.
Here is the final version of my irule:
when SIP_REQUEST {
if { [SIP::method] == "INVITE" && [SIP::uri] matches_regex {^.+@.+$} }
{
if { not ([SIP::uri] matches_regex {^(sip:|sips:)[0-9]{7}@}) }
{
log local0. "SIP Drop for [SIP::uri] from [IP::remote_addr] - possible frauder"
drop
}
}
}
I hope this can be useful for other people having similar case.
regards, Evelin