Voice & messagingTCP/UDP 5060, 5061 Cleartext by default
Port 5060, 5061: SIP
Session Initiation Protocol
Sets up VoIP calls. 5060 is cleartext; 5061 is SIP over TLS. Media flows separately over RTP (SRTP when encrypted).
Secure alternative: SIP over TLS (5061) with SRTP
How attackers abuse it
- Toll fraud through brute-forced extensions.
- Call interception and caller-ID spoofing.
How to defend it
- SIP over TLS and SRTP.
- Strong extension passwords; restrict international dialling.
Exam tip
SIP signals the call; RTP carries the voice. Protect both.