A SIP flood is a Layer 7 attack vector against VoIP infrastructure, one of the application-layer classes a thorough DDoS test is built to exercise. It overwhelms a SIP server (an IP-PBX, session border controller, or registrar) with a high rate of Session Initiation Protocol messages, most often INVITE or REGISTER requests. Each request forces the server to allocate call or transaction state, run authentication, and hold the dialog open awaiting a reply that never comes. Because SIP commonly rides UDP, source addresses are easy to spoof, and a modest packet rate can exhaust the transaction table and worker threads long before raw bandwidth becomes the constraint.
Why it matters in DDoS testing
Voice infrastructure fails in ways a web load test never surfaces: registration storms, call-setup latency, and one-way audio as media gateways starve, all while the network link looks healthy. A test measures how the PBX or session border controller behaves as the INVITE and REGISTER rate climbs, whether rate limiting and SIP-aware inspection hold the transaction table below its ceiling, and where call quality degrades first. That failure-under-load question is the substance of DDoS resilience testing.