We have global rate limit and ACL but not rate limit per IP. We don't have any automatic blacklist but it's a good idea.

That would definitely be a good idea; especially for not necessarily malicious users; what about bad IADs in the field. Also, testing out things with rfc4475 (SIP Torture Test) http://tools.ietf.org/html/rfc4475 Also, any testing with tools such as: voiper (http://voiper.sourceforge.net/) INVITE Flooder (http://www.hackingvoip.com/sec_tools.html) SipBomber (http://www.metalinkltd.com/downloads.php) I understand that people are placing FS on a protected network but if it's going to face the internet as an SBC, it should at least be fortified to handle the beating. thanks for your time and great work, eric clope