Test your SIP server at KwanLabs and use the code SUMMER3X40 for a 40% discount for 3 months 😎

April 12, 2026

185 words 1 min read

MockaSIP: The Simplest Way to Test SIP Error Handling

MockaSIP: The Simplest Way to Test SIP Error Handling

Web developers have for years been able to test their APIs using multiple online mock API services but SIP/VoIP platform developers usually have to build their own.
How do you test that your SIP call error handling is working well?
When your SaaS provider tells you “You can bring your own carrier to our platform and we will failover the calls automatically for you” How do you check the errors they failover on? Throw live traffic and then realize that they are not failing over on some 4xx error messages?
Want to do some CI/CD SIP application tests?
Now there is Mock-A-SIP 😉 The idea I went with is simple, send a SIP INVITE and have the user part of the URI end in the error code you wish. For example INVITE sip:404@mockasip.com gets a 404 “Not Found”. INVITE sip:+353123486@mockasip.com gets a 486 “Busy Here” etc

Things to note:

  • Obviously only 300 - 699 codes are handled
  • No authentication is required
  • TLS is not supported for now

A bit more details can be found at mockasip.com so go ahead, visit mockasip.com and start testing today.

kamailio automation CI/CD sip
Another Open Relay Scan

Another Open Relay Scan

June 28, 2023

In May this year, the number of SIP scanning started increasing again. Such an increase in scanning can be easily noticed when looking at the free, publicly available honeypot data that I provide. For example, data like the one in the picture below where you see IP addresses, usually from the same subnet, with a low count of requests made to the honeypots, is a strong indicator of automated scanning.
Massive SIP Attacks with VPN?

Massive SIP Attacks with VPN?

September 7, 2022

The picture I like to keep an eye on the hourly data statistics of my honeypots just to see if anything interesting pops up. A couple of weeks back I saw something that I just had to take a screenshot of Screenshot of the automated traffic It screamed automation. I quickly tried to see if it was another round of traffic similar to the proxy relay traffic that happened some time back …… It wasn’t, so I didn’t make too much of it.
Open Relay Abuse

Open Relay Abuse

March 31, 2022

The story I really didn’t give much attention to the ‘Country analysis’ world heatmap tab on the SIP honeypot data web interface till I one day noticed that every hour there were over 100 unique IP addresses from the US attacking my honeypots. Checking the database I noticed a pattern in the format of the stored headers in the database. Next I checked the source IPs of the suspicious traffic in Shodan.