TFPS

Open source · self-hosted · Linux

Make hostile SIP traffic disappear.

TFPS reads SIP directly from the wire, identifies scanners and brute-force sources, and drops them at XDP—before they reach your softswitch, logs, or packet capture.

Get started View source ↗
  • ≈ 4.3 MBstatic binary
  • 0 portsbound by TFPS
  • Kernel-levelenforcement
TFPS — Telephony Fraud Prevention Service
NIC→XDP DROP HERE→ sngrep / tcpdump→softswitch

Two layers, one binary

Useful from the first packet.

Prevention is on by default. Behavioural detection is an explicit, experimental second layer for compromised downstream PBXs.

01 / DEFAULT

Perimeter prevention

Recognizes scanner identities, hostile URI shapes, rejected credentials, registration sweeps, and optional APIBAN sources.

  • Works without a learning period
  • No softswitch log configuration
  • Temporary, inspectable blocks

02 / EXPERIMENTAL

Behavioural detection

Learns each source’s international calling pattern and reports anomalous scans and volume—even when the attacker has valid credentials.

  • Opt-in with --behavioural
  • 30-day learning window by default
  • Detection and reporting today

Built for operators

Not another service in the call path.

01

No cloud dependency

One local binary, SQLite, and the Linux kernel. Your SIP stays on your network.

02

No UDP bind

AF_PACKET observes traffic without competing with your PBX or proxy for port 5060.

03

Visible decisions

Inspect blocks, reasons, counters, and learned state with tfps_ctl.

Install

One line. Two minutes.

Linux x86_64, kernel 5.15 or newer with BTF, systemd. The installer fetches the latest release, compiles the XDP program against your kernel, installs the service and starts it. Run it again to upgrade; your configuration is never overwritten.

sh
# Install or upgrade, on the machine that runs your SIP service
curl -fsSL https://tfps.co/install.sh | sh

# Watch it decide, and ask what it knows
journalctl -u tfps -f
tfps_ctl status

Read INSTALL.md for prerequisites, pinning a version, air-gapped hosts, observe-only rollout and uninstalling.

Honest boundaries

Know what it does not inspect.

SIP over TLS payloadsSIP/TCP detectionIPv6 traffic Behavioural enforcement

Known-bad sources can still be enforced across configured TCP SIP ports. Full limitations are documented in the project README.