TFPS

Open source · self-hosted · Linux

Make hostile SIP traffic disappear.

TFPS reads SIP directly from the wire, identifies scanners and brute-force sources, and drops them at XDP—before they reach your softswitch, logs, or packet capture.

Get started View source ↗
  • ≈ 4.3 MBstatic binary
  • 0 portsbound by TFPS
  • Kernel-levelenforcement
TFPS — Telephony Fraud Prevention Service
NIC→XDP DROP HERE→ sngrep / tcpdump→softswitch

Two layers, one binary

Useful from the first packet.

Prevention is on by default. Behavioural detection is an explicit, experimental second layer for compromised downstream PBXs.

01 / DEFAULT

Perimeter prevention

Recognizes scanner identities, hostile URI shapes, rejected credentials, registration sweeps, and optional APIBAN sources.

  • Works without a learning period
  • No softswitch log configuration
  • Temporary, inspectable blocks

02 / EXPERIMENTAL

Behavioural detection

Learns each source’s international calling pattern and reports anomalous scans and volume—even when the attacker has valid credentials.

  • Opt-in with --behavioural
  • 30-day learning window by default
  • Detection and reporting today

Built for operators

Not another service in the call path.

01

No cloud dependency

One local binary, SQLite, and the Linux kernel. Your SIP stays on your network.

02

No UDP bind

AF_PACKET observes traffic without competing with your PBX or proxy for port 5060.

03

Visible decisions

Inspect blocks, reasons, counters, and learned state with tfps_ctl.

Build and install

Small enough to understand.

TFPS targets Linux kernel 5.15 or newer with BTF. Start in observe-only mode if you want to inspect decisions before enabling XDP enforcement.

bash
# Build the two static binaries
git clone https://github.com/sippulse/tfps.git
cd tfps
cargo build --release --target x86_64-unknown-linux-musl

# Install the service and XDP program as root
sudo ./packaging/install.sh

# Confirm traffic and enforcement
sudo tfps_ctl status

Read the installation guide for prerequisites, configuration, and a safe rollout checklist.

Honest boundaries

Know what it does not inspect.

SIP over TLS payloadsSIP/TCP detectionIPv6 traffic Behavioural enforcement

Known-bad sources can still be enforced across configured TCP SIP ports. Full limitations are documented in the project README.