> Source: [sk68221](https://support.checkpoint.com/results/sk/sk68221)

# sk68221 - Dropped SIP traffic with "Attack: Malformed SIP datagram" and "Attack information: "Illegal 'FROM' user in request packet""

| Property | Value |
|----------|-------|
| Solution ID | sk68221 |
| Date Created | 2012-02-27 |
| Last Modified | 2017-04-28 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * VoIP SIP traffic is dropped by IPS with the following log:

  ```
  Attack: Malformed SIP datagram
  Attack information: "Illegal 'FROM' user in request packet"
  ```

* Kernel debug ('`fw ctl debug -m fw + vm drop`') shows that the traffic is fully accepted, but it does not pass through the Security Gateway

* Kernel debug ('`fw ctl debug -m fw + sip`') shows:

  ```
  
  ;sip_get_user_ex : '+' found. skipping it;
  ;sip_get_user_ex: User contains a reserved character;
  ;sip_send_log_bad_conn_ex : Sending log with info Invalid or no SIP users;
  ```

## Cause

VoIP SIP traffic that has more than one '+' or '\&' character in the 'FROM' or 'TO' part of the header of SIP 'OPTION' packet is not processed properly if the 'FROM' or 'TO' part does not contain the '@' character - i.e., when there is no user (anonymous user).

*Example from kernel debug:*

* To: \<sip:192.168.10.22\>;tag=s+1+1720002+723224dc
* From\<sip:192.168.40.66:5060;transport=udp;lr\>;tag=sip+1+aba0e0a+f5e6cd3e

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content