February 2011 - VoiceOps - lists.voiceops.org

ACMEs SIP Dynamic HNT
by ujjval＠simplesignal.com April 26, 2011

April 26, 2011

Hi Guys: We have not used the ACMEs SIP Dynamic HNT feature, where the ACME sends OPTIONS msgs to individual endpoints on its Access side and adjusts their expires times as per individual Firewalls that they are behind. While it sounds cool, I was wondering if folks have noticed issues with using it given that some endpoints out there don't even honor the Expires header from REGISTRARs and as the ACME determines the correct NAT interval automatically, it may leave some endpoints de-registers for small intervals (as per ACME ACLI guide). Thx for your input UK

6 7

VoIP Abuse Take Two (or three, maybe even 4-5)
by sil＠infiltrated.net March 17, 2011

March 17, 2011

For those looking for a different type of blacklist or at least one that makes sense, please be sure to browse the VoIP Abuse Black List as things are a slightly different now. VABL looks up an attacker's information via Shadowserver's lookup and appends three new fields: type of attacker, address and the letters VABL (so one can know where and how it ended up on being blacklisted) and a number dialed (when appropriate.) The type of attacker field may make the biggest difference to those who decide to use this list. There are two specific entries that will appear: BRU, ADN and COM. BRU means that the host attempted to bruteforce a PBX while COM signifies that the attacker managed to compromise either a honeypot or a live machine. ADN is when an attacker places a call and is short for Attacker Dialing Numbers. Whenever you see an entry with ADN, there will be an additional field at the end with the number dialed by the attacker appended to it. Here are three entries, a COM (someone who accessed a honeypot with a valid account), a bruteforcer and an ADN (an attacker who accessed a compromised account and tried to place a call the number dialed is pre-pended) 85.214.23.191 | COM | VABL | 6724 | 85.214.0.0/16 | STRATO | DE | STRATOSERVER.NET | STRATO RECHENZENTRUM BERLIN 41.232.96.220 | ADN | VABL | 8452 | 41.232.96.0/22 | TE | EG | TEDATA.NET | AFRINIC | 011251912121891 93.126.35.12 | BRU | VABL | 44375 | 93.126.0.0/18 | AISDP | IR | - | ASMANFARAZ SEPAHAN ISDP Anyhow, the list is maintained as a text file and is updated accordingly (once per day depending on my schedule). VABL explained: http://www.infiltrated.net/index.php?option=com_content&view=article&id=17&… VABL list http://www.infiltrated.net/vabl.txt Potential scripting... wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this whole netblock "$9}' wget -qO - infiltrated.net/vabl.txt|\ grep [0-9] | awk '{print "insert your favorite firewall rule against this one host "$9}' Depending on one's POV, COM and ADNs are the ones to keep an eye one. These are actually making connections as opposed to checking if a door is opened. I know I've stated it before, typically I see this: bruteforce --> fire off sipvicious looking for an account attacker --> logs into an account (this IP is RARELY if ever in any bruteforce logs) What I find sort of funny is that today I see an attacker I guess doing research: (attacker trying to make a call to 0112522200044) 41.34.68.219 | ADN | VABL | 8452 | 41.32.0.0/12 | TE | EG | - | TE DATA | 0112522200044 Attacker researching I guess asterisk + voip + security or so $ awk '/host-41.34.68.219.tedata.net/{print $1,$4,$5,$6,$7,$8,$9,$11}' access_log | head -n 1 host-41.34.68.219.tedata.net [17/Jan/2011:13:50:46 -0600] "GET /asterisk-ips.html HTTP/1.1" 200 "http://voipsecurityblog.typepad.com/marks_voip_security_blog/2009/07/a-scri…" -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

3 2

IAM Signals
by clec＠cygnustel.com Feb. 28, 2011

Feb. 28, 2011

I am trying to figure out where the excess of IAM messages is coming from. We get billed for every signal and my bills recently have been saying: SIGNAL SWITCHING...IAM...TERMINATING SIGNALS = 345 SIGNAL FORMULATION...IAM...TERMINATING SIGNALS = 254,181 SIGNAL TNDM SWITCHING...IAM...TERMINATING SIGNALS = 254,181 Is this the count of IAM messages that I am sending to the tandem then? IE. I would have to make 254,181 calls outbound to generate these? Or are these IAM messages inbound and outbound? Is the ratio 1:1 as far as IAM to Calls? Sorry for all the questions, I am just unsure on the IAM details. Thanks! -Eric

3 2

Toll Free Origination Issues Level 3
by robert.dawson＠mindshift.com Feb. 28, 2011

Feb. 28, 2011

Anyone having problems with numbers ringing to an out of service notice?

4 3

Level3 & TATA issues
by owen＠impulse.net Feb. 24, 2011

Feb. 24, 2011

Seeing multiple outages with both Level3 and much of TATA is also affected. Anyone have details? -Owen -- _________ Senior Network Engineer Impulse Advanced Communications 805-884-6332 owen at impulse.net

2 1

RE 3. ACMEs SIP Dynamic HNT (Ujjval Karihaloo)
by CCurry＠telovations.com Feb. 24, 2011

Feb. 24, 2011

We use Dynamic HNT. Feature works good and I have not seen an issue regarding this specific feature. Other firewall issues can cause this feature to be null because the firewall manipulates the sip messaging. All of our sip clients honor our sip expires timer hence we have no issues. -----Original Message----- From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of voiceops-request at voiceops.org Sent: Wednesday, February 23, 2011 6:12 PM To: voiceops at voiceops.org Subject: VoiceOps Digest, Vol 20, Issue 21 Send VoiceOps mailing list submissions to voiceops at voiceops.org To subscribe or unsubscribe via the World Wide Web, visit https://puck.nether.net/mailman/listinfo/voiceops or, via email, send a message with subject or body 'help' to voiceops-request at voiceops.org You can reach the person managing the list at voiceops-owner at voiceops.org When replying, please edit your Subject line so it is more specific than "Re: Contents of VoiceOps digest..." Today's Topics: 1. Re: Screwy DSL modem NAT troubles (Scott Berkman) 2. Question for VoiceOps: Platform Monitoring (Reid Stidolph) 3. ACMEs SIP Dynamic HNT (Ujjval Karihaloo) ---------------------------------------------------------------------- Message: 1 Date: Wed, 23 Feb 2011 13:13:43 -0500 From: "Scott Berkman" <scott at sberkman.net> To: "'anorexicpoodle'" <anorexicpoodle at gmail.com>, "'Carlos Alcantar'" <carlos at race.com> Cc: VoiceOps at voiceops.org Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles Message-ID: <00a501cbd385$67f26100$37d72300$(a)sberkman.net> Content-Type: text/plain; charset="utf-8" My favorite was the Netopia modems ATT/BS was deploying for some time with all their Business DSL circuits (anything with a static IP) that had an ?undocumented? ALG that could be disabled via the CLI but not the GUI, but it defaulted to on. It was of course horribly broken. -Scott From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of anorexicpoodle Sent: Tuesday, February 22, 2011 2:28 AM To: Carlos Alcantar Cc: VoiceOps at voiceops.org Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles Ill second Alex's sentiment on abandoning port 5060 and make the traffic look like something other than SIP so the ALG doesn't get triggered. We've been doing this for years, works like a charm. Speaking of, if anyone from Linksys, D-Link or any other residential grade router manufacturer is out there listening, you have obviously devoted time and effort to coding these ALG's, why not make them work? I would love to hear why it seems there is a concentrated effort to absolutely break voip with atrociously coded ALG's. On Mon, 2011-02-21 at 22:19 -0800, Carlos Alcantar wrote: Linksys ALG seems to break everything sip on the firewall side sonicwall seems to be the death of sip. Carlos Alcantar Race Communications / Race Team Member 101 Haskins Way, So. San Francisco, CA. 94080 Phone: +1 415 376 3314 Fax: +1 650 246 8901 / carlos *at* race.com / www.race.com -----Original Message----- From: voiceops-bounces at voiceops.org [mailto:voiceops-bounces at voiceops.org] On Behalf Of Carlos Alvarez Sent: Monday, February 21, 2011 3:08 PM Cc: voiceops Subject: Re: [VoiceOps] Screwy DSL modem NAT troubles We go through this all the time with Qwest DSL customers. Unfortunately I don't have model numbers for you, we stopped documenting things when we noticed that they have all new modems every few months. However we've had success with having the customer call Qwest and tell them they want to run VoIP phones, the Qwest reps seem to know that as a trigger and send a compatible modem. I do recall that the best ones are Netopia, and we've had good support when we engage them directly via chat. We also find that modems start going bad slowly after a couple years, and VoIP is the first to get impacted, of course. Matthew S. Crocker wrote: > Has anyone else noticed that the latest batch of DSL modems have broken NAT when it comes to VoIP? I'm seeing stable VoIP customer get broken when the DSL modem is swapped out. The modem NATs the phones to modem IP port 5060. So, 10 phones behind the router become one phone to the SBC. A race condition occurs and phones go in and out of service at random. It looks like the router is trying to do a SIP ALG but very very broken. > > Do anyone have a DSL modem/router they use that works well with VoIP? >

1 0

Question for VoiceOps: Platform Monitoring
by reidstidolph＠gmail.com Feb. 23, 2011

Feb. 23, 2011

Hi Voiceops, Curiosity question: What tools do you use to monitor and troubleshoot your platform? Specifically, to track down and troubleshoot small scale issues such as isolated reports of poor call quality, call drops, protocol failures, ect. (i.e. not large scale, such as an entire system failure, interface failure, or switch/router failure) I would categorize the options as: - *Node Level Monitoring * o Logs, CDRs, ect. from individual nodes. These can contain detailed information or protocol traces from that particular node?s perspective in the call flow. o For example, Acme CDRs containing detailed QoS info, disconnect cause codes, network info ect. o Another example might be Broadworks Xlogs, with protocol traces. - *In house Network Monitoring* o Port-mirrors, SBC packet-trace, or passive/active taps at key locations in the call flow, that mirror traffic to a in-house system for analysis. o For example, mirroring traffic to a Linux system and running tcpdump, or snoop to gather pcap traces. - *3rd Party Network Monitoring* o Vendor provided monitoring solutions, that also gather network data from taps or port mirrors. o For example, Brix, Empirix, Netscout, or other, that can provide call data, protocol traces, and media analysis. - *Other?* Note that I am not really interested in specific vendors here. Just looking to poll VoicOps for their usage and preference of the four main categories. In my past experience with service providers, I have used each of the above (some at the same time), and in my opinion they all have their strengths and weaknesses. I would be interested to know your experience with this. Thanks! -Reid Stidolph

1 0

Screwy DSL modem NAT troubles
by matthew＠corp.crocker.com Feb. 23, 2011

Feb. 23, 2011

Has anyone else noticed that the latest batch of DSL modems have broken NAT when it comes to VoIP? I'm seeing stable VoIP customer get broken when the DSL modem is swapped out. The modem NATs the phones to modem IP port 5060. So, 10 phones behind the router become one phone to the SBC. A race condition occurs and phones go in and out of service at random. It looks like the router is trying to do a SIP ALG but very very broken. Do anyone have a DSL modem/router they use that works well with VoIP? -- Matthew S. Crocker President Crocker Communications, Inc. PO BOX 710 Greenfield, MA 01302-0710 http://www.crocker.com P: 413-746-2760

7 10

Question regarding 800 database dips via SIP or ENUM
by mmg＠transtelco.net Feb. 21, 2011

Feb. 21, 2011

Dear list members We are currently in the process of deploying an interconnection agreement with AT&T as a facility based CLEC in Texas. This is our first interconnection and I have some questions in regards to 800 database access providers 1.- We are working with TNS as a signaling provider, however they don't support 800 database dips via SIP/ENUM, they only allow access via SS7 TCAP and the switch we are planning to use does not support TCAP. Could someone recommend a 800 database access provider that allow database dips via SIP or ENUM? 2.- Could you share how are you dealing with 800 databse dips? I would really appreciate any ideas/advice Thank you Manuel Mar?n Transtelco

1 0

Enum for carrier services
by d＠d-man.org Feb. 21, 2011

Feb. 21, 2011

Hello, I am researching whether or not ENUM is a viable solution for carrier-grade infrastructure routing. It has been suggested that utilizing DNS for number lookups within an internal network is a very powerful, redundant way of handling large volumes of traffic while also gaining caching and many years of DNS infrastructure reliability in one shot. Things is, I can't figure out why a 10+ year technology doesn't have excellent penetration if it's this good. I can guess that hooking a bunch of DNS servers to potentially SQL-based DNS servers has the argument of "why not just go direct to the DB to reduce latency/complexity" but DNS provides other advantages, ranging from local caching on each box (comes "free") to inherent redundancy with multiple name servers (though there's a delay in failing over obviously). And of course, if done properly with partitioning, DNS can be done via flat-files for ultimate speed. So, yeah, looking for any good reads on ENUM or other DNS related services, both pros & cons. Suggestions welcome. - Darren

2 2