- VoiceOps - lists.voiceops.org

Quality Problems to Houston
by tdonahue＠theaeonsolution.com Sept. 29, 2010

Sept. 29, 2010

Hello all, We have been getting an abnormally high number of complaints about poor quality to Houston, TX on our Viper trunk with Level 3. Has anyone else seen any quality issues to the Houston area? Tim

1 0

Rate Center to LATA map
by clec＠cygnustel.com Sept. 29, 2010

Sept. 29, 2010

Does anyone know where to get a list of rate centers and what lata they are in? I am trying to redo translations and it is quite difficult without this information! Thanks, Eric

7 16

TCG ICCF proposal for reduction of NXX waste (1996)
by beckman＠angryox.com Sept. 29, 2010

Sept. 29, 2010

http://www.allbusiness.com/energy-utilities/utilities-industry-public/72301… WASHINGTON--(BUSINESS WIRE)--May 14, 1996--A plan released today by Teleport Communications Group (TCG) could help slow the rate at which telephone numbers are being used in states from coast to coast. TCG's plan would also reduce the need for new area codes thus avoiding the customer confusion and costs that often result when new codes are introduced. I suppose this never got implemented... --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------

2 1

Ratecenter NWYRCYZN02 - Where did it go?
by beckman＠angryox.com Sept. 27, 2010

Sept. 27, 2010

I'm trying to find any NANPA newsletters or other documentation that proves that NWYRCYZN02 (Midtown Manhattan best I can tell) was removed as a valid ratecenter, what happened to it, and if it was merged with Zone 1 or Zone 3 or if the boundries were rewritten. Two reasons I need this info: 1. My own internal NANPA map seems to show it exists for three NPAs: 212, 646, 917 If it is gone, I need to update my data. 2. My DID providers are still offering DIDs in this ratecenter. If it doesn't exist, I want some evidence of it so I can go back to them and tell them what is correct. A google search of NWYRCYZN02 with the restriction of "site:nanpa.com" also checking: nationalpooling.com, nationalnanpa.com, nationalnanpa.us, verizon.com, areacodedownload.com If anyone has any further info, I'd appreciate it. I made a map of NYC Zones with data I found elsewhere on the 'net. Hope it is useful to someone. http://img175.imageshack.us/img175/920/macvimscreensnapz001.jpg --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------

1 1

VoIP Abuse Project Followups
by sil＠infiltrated.net Sept. 27, 2010

Sept. 27, 2010

Hey all, thanks to everyone whose mailed me both on and off-list in regards to the VoIP Abuse Project. Before things spiral out of control, I decided to make things a bit more detailed and easier to access as well as adding all addresses of attackers, not only ARIN addressing. There are seven sections in which I will try to keep as current as possible: Addresses: These are the IP addresses of bruteforcing hosts Netblocks: These are the netblocks of attacking hosts Numbers Called: These are the numbers called by attackers from my honeypots E-mails Sent: These are the e-mails sent to abuse desks Responses Received: These are the responses (if any) received in response to my e-mails Attack logs: These are the logs of attacks Defensive suggestions: IPF/IPTables/PF based script for Asterisk PBX's Submissions Removals: Information on submissions and removals Any recommendations and or feedback is greatly appreciated. I believe the "Numbers called" section would interest investigators in determining the potential identification of an attacker. This is based upon one and a half years of monitoring, correlating and studying attack patterns. The page is self explanatory on my theories. For admins and engineers under attack, the defensive suggestions may assist in minimizing attacks. And finally, "A Simple Asterisk Based Toll Fraud Prevention Script" (http://www.infiltrated.net/asterisk-ips.html) This document led to the framework of a honeypot I created and maintain across numerous managed, public-facing, Asterisk PBX servers. For admins, owners and engineers on the list, see removals: Lest I forget to give thanks to those in the industry who've given me ideas and inspiration to pursue this hobby/project: Mark Collier, David Endler (they wrote the book on Hacking VoIP which is a definite must read not only for pentesters, but for admins and engineers), Sandro Gauci for always taking the time to respond to some of my ramblings. David Hiers and the rest of the Voice-Ops list for tolerating me. Shawn Merdinger, Dan York and the rest of the VoIPSA list for tolerating my ramblings. -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

2 2

Rate Center Maps, Locations for NPANXXs
by beckman＠angryox.com Sept. 26, 2010

Sept. 26, 2010

In the past I've paid MelissaData.com $400 or so to get access to their NPANXX-Ratecenter-Location-GIS data. For each NPANXX, they list the Ratecenter, City and state/region, Lat/Lon coordinates. It's fairly accurate, though I'm not entirely sure how they get the data. TelcoData.com doesn't keep City/State or Lat/Long coordinates of the NPANXX, only the switch that serves the block. The problem is that, for example in DC, Washington DC Zone 17 seems to be served from Beltsville, MD, but 571-269-3 is a Virginia, likely Arlington, exchange. So taking the switch location as the lat/lon for the npanxx block is very incorrect. Cloudvox's API is awesome (Thanks Cloudvox!), but outside of Country, Region and Ratecenter, the city and location data from their API has been somewhat wrong. Examples: http://digits.cloudvox.com/571/269/3 Ratecenter: WSNGTNZN17 VA City: WSNGTNZN08 (what?!?) Lat/Lon: 37.4315734, -78.6568942 (the center of Virginia, not even close to the DC area) http://digits.cloudvox.com/805/316 Ratecenter: SNLUSOBSPO CA City: SANBARBARA (Not a valid city name) Lat/Lon: 36.778261, -119.4179324 (155 miles from San Luis Obispo, CA) There are others, but I won't bore you. To give them credit, they have a "geo_precision" which I assume tells you how many significant digits you can trust, but is not mentioned in the API docs ( http://help.cloudvox.com/faqs/digits/digits-phone-number-location-lookup-api ) Plus it is limited to US only (recently addressed here or on asterisk-biz, may change). LocalCallingGuide.com is a bit better at their lat/lon, but they don't include City name, they only offer XML and not JSON or another parseable format, and they don't list the ratecenter in the LERG 10 char format. http://localcallingguide.com/xmlprefix.php?npa=571&nxx=269 I'm expecting WSNGTNZN17, not "Washington Zone 17" as the Ratecenter. Between the TelcoData.com, three, I can inconsistently and automatedly get the data I need. I'd like to start offering a map of numbers available, but the map is only as good as the data behind it. Is there another more accurate source that people use? Beckman --------------------------------------------------------------------------- Peter Beckman Internet Guy beckman at angryox.com http://www.angryox.com/ ---------------------------------------------------------------------------

6 8

SIP test equipment
by kristian.kielhofner＠gmail.com Sept. 26, 2010

Sept. 26, 2010

Hello everyone, What do you currently use for test equipment? I'm looking for high volume automated testing with statistics and reporting, especially for media (RTP). Just SIP + RTP in our environment, ability to support 2,000 RTP channels minimum with at least MOS (preferably PESQ) scoring. G.729, G,711(u/a), and G.722 (minimum) codec support. Emulated UAS/UAC, gigabit ethernet interfaces, etc. I'm already looking at Ixia IXLoad and Empirix Hammer G5 but I wondered what else people are using... -- Kristian Kielhofner http://www.astlinux.org http://blog.krisk.org http://www.star2star.com http://www.submityoursip.com http://www.voalte.com

5 6

Broadsoft Dialers
by csteinman＠rgts.com Sept. 23, 2010

Sept. 23, 2010

Does anyone know of any Autodial vendors (Predictive, Campaign) that integrate with Broadsoft. Thanks, Charles Steinman Senior Converged Network Engineer 1221 Avenue of the Americas New York, NY 10020 212-282-2249 www.rgts.com

2 1

VoIP Abuse Project Follow Up
by sil＠infiltrated.net Sept. 21, 2010

Sept. 21, 2010

For those interested in yet MORE information. http://www.infiltrated.net/voipabuse/honeypot/ -- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently." - Warren Buffett 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E

1 0

VoIP Abuse Project
by ldardini＠gmail.com Sept. 20, 2010

Sept. 20, 2010

2010/9/20 VoIP Abuse Project <voipabuse at infiltrated.net> > Leandro Dardini wrote: > > Hello, > > I find a blacklist too heavy to manage and unable to catch the fast > > emerging bruteforcers. As freelancer I suggest to my clients (all on > > Linux with Asterisk) the install of the fail2ban software. > > > > The working of fail2ban software is really simple: it reads the > > messages generated by the application and if one user try to > > authenticate with wrong credentials more than X times in the unit of > > time, then triggers an insert into iptables to not get more packets > > from him for a long time (adjustable). > > > > Leandro > > Understood on fail2ban however, I can use fail2ban against you and have > your own servers block their upstream. Fail2Ban "fails" when you're in a > managed PBX arena and your clients are connecting from all over the > place. When you have thousands of customers and some are connecting from > all over the place, fiddling with Softphones, settings in Snom, Polycom, > etc., you will quickly learn that Fail2Ban outright fails. > > While a blacklist CAN be cumbersome, this isn't like spam where there > are millions of hosts attempting this per day. At maximum, I've seen > about 15-20 hosts attacking one PBX. It will take me about 20-30 minutes > to whip up a python or shell script to parse them out and upload them. I > already have my honeypot writing to DB, all I have to do is re-write to > gzip and send the full logs. > > The hard part is writing an informative email someone will likely never > read (abuse departments). Last thing I want to hear is "you're not > playing fair" when their clients complain. > > -- > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ > J. Oquendo > SGFA, SGFE, C|EH, CNDA, CHFI, OSCP, CPT > > "It takes 20 years to build a reputation and five minutes to > ruin it. If you think about that, you'll do things > differently." - Warren Buffett > > 227C 5D35 7DCB 0893 95AA 4771 1DCE 1FD1 5CCD 6B5E > http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x5CCD6B5E > > I am sorry, but I really don't understand how fail2ban can be used against me. The only drawback of fail2ban is when inside a large private organization using NAT and exiting on Internet with a single (or small pool of) IP, some evil colleagues can send a bunch of wrong REGISTER requests and trigger fail2ban to filter the IP preventing legitimate users from within the same organization to access your service. This can happen once, then the good sysadmin of the organization will snoop the traffic and catch the evil colleagues. Leandro

7 8