I have been thinking about only accepting tcp/tls on the public profile and blocking udp at the border. The peer will have to do the 3 way handshake which means we know they have a valid source ip:port before they get up the sip stack I'm sure this is not a new idea. Any thoughts? -- Sincerely, Russell Treleaven sip:rtreleaven@sip.bunnykick.ca;transport=tcp