Tag Info

Hot answers tagged

15

I found the solution after spending roughly 40 hours on this problem. There is a setting in the switch that enables "Auto DoS" protection. Apparently it considers TCP or UDP traffic that has matching source or destination ports to be a blat attack and drops the packet. This is ridiculously short-sighted since SIP traffic often (always?) relies on source ...


12

All the answers to your questions are "it depends". If you use a PBX system like Asterisk where the audio data is actually handled by the server computers you'll have much steeper CPU and I/O demands on the server computer (along with finicky reliance on timing-- something that virtual machines don't necessarily do a great job with). If you a PBX system like ...


11

nmap -v -sV localhost -p 5060 will tell you the truth. You can also use: netstat -apnt | grep 5060 or ss -aln


9

A good rule of thumb comes from old telephony .. an phone T1 line 24 voice channels and a control channel. This equates to roughly 64Kb/s per phone line. This rule works (roughly) for uncompressed VoIP. There are various codecs that do compression .. the G729 should roughly triple that, so get 72 voice channels on a T1. If you expect all 55 phones to be ...


9

Virtualizing a PBX is a challenge, due to one main aspect: There is no guaranteed scheduling of your PBX VM and the general scheduling behavior could introduce jitter. That being said you also have to think about how your line-cards (if you need S0 to some other PBX etc.) need to be presented to the VM and if things like vMotion and HA make sense. There are ...


7

I have come across the same problem and it's not just limited to asterisk. In the end we came up with something that worked well for us. We called it a SIP Loopback. Basically we signed up for an ALT sip provider (flowroute.com) and setup a script that calls out via primary SIP provider to the phone number setup with our ALT provider three times an ...


7

lsof -i:5060 will not only show if it is open but what its actually doing. Example: root@root.com# lsof -:5060 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME asterisk 1146 root 18u IPv4 0xffffff000a053c60 0t0 UDP *:sip asterisk 1146 root 18u IPv4 0xffffff000a053c60 0t0 UDP *:sip asterisk 1146 root 18u IPv4 ...


6

The publicly available SipVicious script that many of these attackers use stops the attack instantly if it receives an invalid SIP response with no From: line. You can identify SipVicious because it sets its User-Agent in the SIP requests to friendly-scanner. Using this technique against a real-world attacker, I have been able to immediately stop the flood ...


6

VOIP. Voice over IP. It requires quite a few more things to be configured than plugging a phone into ethernet, but that puts you in the neighborhood.


5

SIP is IP, so yes it's routable. That said, it is tricky to get it to play well with NAT. Verify that your firewall rules are ok, both for signaling (5060) and RTP (most cases 10000-20000).


5

To keep this on-topic, and not make this opinion-based I'll just speak to the technologies you mention in your question. re: managed versus unmanaged An unmanaged switch gives you no functionality to monitor the switch. You can't see packets sent / received, error counts, etc. They're just a "black box" that moves packets. Typically you don't get virtual ...


5

Phone numbers and "SIP URIs like me@domain.com" are different kinds of URIs. A phone number can be represented as a URI like this: tel:+12125551212 whereas a "SIP URI like me@domain.com" can be represented as a URI like this: sip:me@domain.com Many SIP user agents don't actually use tel: URIs. Instead they just take the number that the user dialed and ...


5

With sipcmd https://github.com/tmakkonen/sipcmd you can do it on one line: sipcmd -u <login> -c <passwd> -P sip -w <sipproxy> -x "c<phonenum>;ws3000;v<audiofile>;h"


5

If you already have Asterisk running, setting up a task to dial a number and wait for the other side to answer and play an audio file is not that hard. But 'having Asterisk running' does not answer 'simple'. Google suggests pjsua.


4

There is a free (GPL) tool called SIPp (distributed as sip-tester by Debian and its derivatives) that will allow you do something along these lines. For example: ./sipp -sn uac <IP address> tells it to use the built in UAC scenario and to send the request to the IP address specified. Once the call is answered it can play audio, but this needs to ...


4

The only thing I can think of is if your router has a SIP ALG and is crashing because of some bug in it when it doesn't get the ACK. If your router does have a SIP ALG you should try and find a way to turn it off. It's generally accepted now that SIP ALG's are bad news and cause far more problems than they ever solve. Update: If you're writing your own SIP ...


4

If you have the bandwith (roughly 100 kbps per call), G711 should give you best call quality (and least CPU usage in case Asterisk is transcoding). Otherwise, G729 is a good choice. These two should be supported by most hard- and softphones. For more exotic codecs, check what your phones support.


4

If you can keep your Asterisk PBX in the game, it looks like Skype is interested. The Skype for SIP Beta program maybe what you're after. This way, any SIP or IAX2 client may have Skype incoming and outgoing access.


4

Trixbox is pretty good (http://www.trixbox.org/). It's basically Asterisk but shake'n'bake style. Their community edition is a free version which installs Asterisk plus some fancy front-end tools among other things. It has IVR (auto-attendant), SIP support, remote extensions and other cool stuff. Try it out.


4

The system is waiting for further input to determine whether the complete extension is '1' or something else that starts with '1'. Do you have other extensions in that context that start with the number 1? Check your dialplan.


4

It appears that someone can't spell phoneproxy correctly when they typed it in setting it up. Regardless it's for CUCM's phone proxy feature on an ASDM firewall. See here: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/unified_comm_phoneproxy.html Here's the gist of it: The Cisco Phone Proxy on the ASA bridges IP ...


3

This is indeed more a network troubleshooting question than InfoSec. nmap is a great tool for scanning ports but since you do have access to each endpoints, I would use netcat to troubleshoot this. According Wikipedia, SIP listen on 5060 / 5061 (UDP or TCP). To verify what port is listening you can use one of those tools on the SIP server: lsof -P -n ...


3

You ask multiple questions, I can answer some, but not all of them. why asterisk is running on loopback address and not on 192.168.32.181:5038 As far as I can tell from a few searches port 5038 is the asterisk management interface. So I assume it binds to 127.0.0.1:5038 for security reasons. You wouldn't want that to be accessible from everywhere. ...


3

Talk to your upstream provider. Mine has a blacklist with a REST API that I can feed IP addresses to. I set up fail2ban to call this webservice and packets are stopped somewhere in my provider's network before they reach my firewalls.


3

http://www.mitel.com/resources/242_9113-Mitel3300ControllersDataSheet.pdf Looks like it supports both SIP endpoints and SIP trunks. (which would be SIP from an ISP, yes)


3

I asked the same question in the Asterisk IRC channel on freenode, and one of the developers responded indicating that in newer asterisk versions (I assume 1.8 and above) you need to specify callcounter=yes in your general config of sip.conf. He also mentioned that call-limit should never be zero, as that is not technically a valid option for that field. ...


3

Your best bet would be to set up a site-to-site secure VPN and let the phones download their configuration via TFTP over the VPN. The fundamental problem in this situation is that, even if you had a "secure" protocol over which to download the configuration, you would still have to provide the phone with some kind of security credentials (public/private key ...


3

I've seriously considered this in the past and come up with one very good reason not to virtualize. What happens if you want to connect your PBX to the standard PSTN network? Since doing so requires custom hardware it makes sense to avoid going virtual. This has the added benefit of if your SIP provider craps out you still aren't totally out of business.


3

I was thinking since these phones generate SIP traffic, I could capture that traffic for later analysis. TOTALLY wrong problem as the SIP part does not contain any audio. SIP = Session Initiation Protocol. It controls the cahnnels, but not the content. YO u need to use a SIP server that intercepts and rewrites all SIP and forces the traffic through ...


3

1) VirtualBox isn't really suitable for anything production-grade. Use VMware or KVM instead. 2) Your problem is probably because your Virtual Machine is using the NAT network adapter type, and you should set it to Bridged, and reboot your virtual machine. Then the VM will get an IP address on the rest of the network, in your case, 192.168.x.x. You ...



Only top voted, non community-wiki answers of a minimum length are eligible