Skip to content
AI Dialer

Glossary · Voice technology

What is SBC (session border controller)?

  • Also called: session border controller, border controller

Reviewed by Sujan ThapaliyaLast updated

Definition

A session border controller sits at the edge of a voice network, controlling which calls may cross it. It handles security, NAT traversal, protocol normalisation between systems that implement SIP differently, and rate limiting against attack.
The three STIR/SHAKEN attestation levels, which underpin how sbc (session border controller) behaves in practice: A asserts both that the carrier knows the customer and that the customer may use the calling number, B asserts the customer only, and C asserts neither. A shared number pool can reach B at best, which is why number ownership keeps recurring in these definitions.
Attestation is the backdrop to most caller-ID and deliverability terms, sbc (session border controller) included.

In practice

How sbc (session border controller) actually works

It is the firewall of voice, and it does the job a general-purpose firewall cannot: understanding call state, so it can allow the media that belongs to an established call and refuse everything else.

Normalisation is the underrated function. Two vendors' SIP implementations rarely agree in the details, and the SBC is where those differences are reconciled instead of in either system.

It is also the enforcement point for concurrency and destination limits, which is the practical defence against toll fraud running up a bill overnight.

An SBC is also where topology hiding happens: internal addressing, extension numbering and the shape of your phone system stop being visible from outside. That matters less for security than the access control does, but it removes a reconnaissance step for anyone probing the network.

Worked example

An SBC enforcing a 20-channel concurrency limit caps a compromised extension at 20 simultaneous fraudulent calls instead of several hundred. That limit is the difference between an incident and a catastrophe.

SBC (session border controller): common questions

Do I need an SBC?
If you run your own PBX with a SIP trunk into it, almost certainly. If your platform is fully hosted, the provider operates one on your behalf and you never see it.
Is an SBC the same as a firewall?
No. A firewall filters packets without understanding calls; an SBC tracks call state, so it can open exactly the media path a legitimate call needs and close everything else.
How does an SBC help against toll fraud?
By enforcing limits the PBX may not — concurrent calls, destinations allowed, calls per minute — and by refusing registration attempts that look like credential scanning.

Sources

  1. Combating Spoofed Robocalls with Caller ID Authentication — Federal Communications CommissionThe STIR/SHAKEN framework, the attestation levels carriers sign calls with, and the mandate requiring providers to authenticate caller ID.
  2. 47 U.S.C. § 227 — Restrictions on the use of telephone equipment — Cornell Legal Information InstituteThe Telephone Consumer Protection Act itself — the consent requirements, calling-hours limits, and private right of action.
  3. ITU-T Recommendation E.164 — The international public telecommunication numbering plan — International Telecommunication UnionThe international number format, the 15-digit maximum, and how country codes and national numbers compose.

See sbc (session border controller) in the product

SIP trunking carries your phone calls over the internet to and from your existing PBX, replacing physical ISDN or PRI lines. You keep your phone system and your numbers; you drop the copper, the per-channel rental, and most of the long-distance bill.

Explore sip trunkingGet early access