1 Table of Contents: I. H.323 Protocol Overview Components H.225 RAS Q.931 H.245 H.235v2 (Security) H.323 & FireWalls II. /Skinny III. RTP and RTCP IV. SIP Sample SIP Session Request Methods Request Headers Replies SDP SIP & FireWals APPENDIX Suggested Reading 105 About the Author: Jonathan Levin specializes in training and consulting services. This, and many other training materials, are created and constantly updated to reflect the ever changing environment of the IT industry. To report errata, or for more details, feel free to This material is protected under copyright laws. Unauthorized reproduction, alteration, use in part or in whole is prohibited, without express permission from author. I put a LOT of effort into my work (and I hope it shows). Respect that. (C) 25,26 - All Rights Reserved 2
2 Cisco Proprietary protocol, also Q.713 Used in IP Phone Call Mgr. communications Utilizes TCP port 20 Protocol is lightweight and minimal Phone is really a dumb terminal controlled by CCM The Cisco Skinny protocol was originally developed by the Selsius Corporation. With their acquisition by Cisco, this became a Cisco propietary protocol, that is used in the communication between the Cisco IP Phones (mostly 79xx) and the Cisco Call Manager. The protocol is a very lightweight one (hence the nickname Skinny ). The Call Manager does all the H.323 and SIP processing, acting as a proxy, leaving the IP Phone the task of processing the VoIP RTP datastream. The protocol is rather scarcely documented, as full documentation is available only to Cisco affiliates. The rest of this section attempts to explain this protocol, thanks to a lot of research, packet captures, and common sense. (C) 25,26 - All Rights Reserved 50
3 Messages (in order of appearance) Stage I Phone/CallMgr registration Msg Usage Data 01 RegisterMessage Device Name, Station UserID & Instance, IP Address, Device Type, Max Streams 02 IPPortMessage IP and Port Terminal is listening on 81 RegisterAckMessage Keep Alive Interval, Date Template (M/D/YA), Secondary Keep Alive Interval 9B CapabilitiesRequest Call Mgr asks for Station capabilties 10 CapabilitiesResponse CapCount capabilities(payload/maxframesperpacket) 0F VersionRequest Station requests Call Mgr version 98 VersionResponse Call Mgr Version 0E ButtonTemplateRequest ButtonTemplateMessage Button offset/count and 40-something button defs 0D TimeDateRequest DefineTimeDate Y/M/WD/D, Hour/Min/Sec/mSec, 32-bit TimeStamp : Phone to Call Mgr : Call Mgr to phone The table above shows the message type, as they appear in the lifespan of a telephone. In particular, this table shows the phone registration process with the call manager. The phone registers its IP, as well as its type and name. The CCM asks it to provide its capabilities (voice/video codecs supported). It then caches the IP-Phone capabilities and translates them to H.323 capabilities. The illustration to the right depicts a typical Registration message, as captured by Ethereal s protocol dissector. (C) 25,26 - All Rights Reserved 51
4 The Capabilities Response message is shown in the following illustration: (C) 25,26 - All Rights Reserved 52
5 Messages (in order of appearance) Msg Msg Usage KeepAliveMessage KeepAliveAckMessage Alarm Message Usage OffHookMessage DisplayTextMessage SetLampMessage CallStateMessage DisplayPromptStatus SelectSoftKeysMessage Stage I ½ Keep Alive/Alarm Messages ActivateCallPlaneMessage -- (sent periodically by phone) -- (sent periodically by callmgr) Alarm Severity, Display Message & Params Stage II Picking up the handset -- ASCII text, NULL terminated Stimulus, StimulusInstance, LampMode Call State (code), Line Instance, Call Ident Timeout, DisplayMessage*, Line Inst, Call Ident Line Instance, Call Ident, SoftKeySet, SoftKeyMap (16-bit bitmap) Line Instance Data Data 82 StartToneMessage Dial Tone (as 32 bit identifier) : Phone to Call Mgr : Call Mgr to phone The phone periodically sends KeepAlive messages to the CCM (as instructed by the CCM during the registration). Alarms are sent in case of errors network errors, mostly, such as a phone s inability to load a file from the TFTP, etc. When a user picks up the handset, the phone sends an OffHook message to the CCM. The CCM, in turn, tells the phone e-x-a-c-t-l-y what to do. From the lamp on/off, through the prompt, key settings, and even the dialtone. (C) 25,26 - All Rights Reserved 53
6 Messages (in order of appearance) Msg F A B Usage KeyPadButtonMessage StopToneMessage CallInfoMessage OpenReceiveChannel StartMediaTransmission OpenReceiveChannelAck OnHookMessage ClearPromptStatusMess.. CloseReceiveChannel StopMediaTransmission Stage III Placing a call Dialed Digit 0110 may follow to reconfigure softkeys.. Calling/Called Party & Party Names, Line Inst., Call Ident, Call Type, Orig. called party Receive Channel Details.. Transmission Channel Details.. Status, IP, Port, Pass Through Party ID -- (serves as a call hangup) Line Instance, Call Ident Data Conf Id, Pass Through Party Id Conf Id, Pass Through Party Id : Phone to Call Mgr : Call Mgr to phone The phone signals the end of a call by an OnHook message, telling the call manager the user replaced the handset (therefore hung up the call). It s then that the Call Manager tells the phone to stop transmitting, close the channels, set the call State to OnHook (= disconnected), and present the default user prompt. (C) 25,26 - All Rights Reserved 54
7 Messages 1 or more messages per packet Made up of 4-byte fields Length First field is length of message Message ID 2 nd field is reserved (0x) 3 rd field denotes message type Optional Message Data (Length - 8 bytes) Rest of message is variable As stated, is an extremely simple (and wasteful(!)) protocol. The slide above depicts the basic format of a message. All fields are 4 bytes (i.e. words), for easier processing at the phone side. The first field is the length of the message (i.e. the rest of the fields, excluding the reserved field, next, which is always zero). Then, the message type and, if applicable, message arguments. Most messages, however, are of fixed size, as they have a predefined number of arguments. The messages containing strings, however (usually NULL terminated), may differ. (C) 25,26 - All Rights Reserved 55
8 Messages KeyPadButtonMessage 08 CallStateMessage Key Pressed (0-9, *, #) Call State Line Identifier Call Identifier State 0x02 0x05 0x12 Purpose On Hook (= disconnected) Connected Proceed (= dial ok) The slide above shows the important dialing messages that supports. These are the KeyPadButton Message (for each dialed digit) and the CallState Message. The latter is sent by the Call Manager to the Station at various stages of the call lifespan, with the codes specified in the table above. Note, again, that the protocol is VERY wasteful. Each digit is sent on its own in a KeyPadButton Message (as one byte out of the four). (C) 25,26 - All Rights Reserved 56
9 Messages Conference ID Pass Through Party ID Remote IP Address Remote Port MS/Packet Payload capability StartMediaTransmission 2C 8A Media Transmission Data Precedence Silence Supression Max Frames Per Packet G.723 Capability The Start Media Transmission is one of the more complex messages, due to its many fields. Its format is shown above, and in the following illustration. The Payload Capability denotes the type of RTP transport (e.g. 4 for G.711, as we have seen for H.323). RTP is handled next. CCM instructs phone to connect to this IP and port with RTP (C) 25,26 - All Rights Reserved 57
10 Firewall Features Standard VoIP defenses No specific options aside from basic validation NAT features not supported (C) 25,26 - All Rights Reserved 58
ADMINISTRATION GUIDE Cisco Small Business SPA2102, SPA3102, SPA8000, SPA8800, PAP2T Analog Telephone Adapters Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the
Analysing the Characteristics of VoIP Traffic A Thesis Submitted to the College of Graduate Studies and Research in Partial Fulfillment of the Requirements for the degree of Master of Science in the Department
C H A P T E R 4 Session Initiation Protocol The Session Initiation Protocol (SIP) is an Internet Engineering Task Force (IETF) standard call control protocol, based on research at Columbia University by
Voipswitch Manual for version 340 and higher by Gabriel Georgescu 1 OVERVIEW 3 SOFTSWITCH 4 REQUIREMENTS. 10 PROGRAM INSTALLATION. 10 LAUNCHING THE MAIN APPLICATION VOIPSWITCH 12 GATEWAYS 18 GK/REGISTRAR
Grandstream Networks, Inc. HT502 Dual FXS Port Analog Telephone Adaptor HT502 User Manual Firmware Version 184.108.40.206 www.grandstream.com email@example.com TABLE OF CONTENTS HT502 User Manual WELCOME...
A Multi-Signaling Protocol Architecture for Voice over IP Terminal Anoop Kumar K. 1 and Tanu Malhotra 2 Wireline Systems Group, R&D Centre, STMicroelectronics AP Pte. Ltd., 20, Science Park Road, #01-28
Avaya one-x Deskphone Edition for 9600 Series IP Telephones Administrator Guide Release 3.1 16-300698 Issue 7 November 2009 2009 Avaya Inc. All Rights Reserved. Notice While reasonable efforts were made
Grandstream Networks, Inc. Analog IP Gateway GXW410x 4 or 8 FXO Ports GXW410x User Manual Firmware Version 220.127.116.11 www.grandstream.com http://esupport.grandstream.com TABLE OF CONTENTS GXW410X USER MANUAL
Service Manual T3 IP Telephones Connected to IP Office Supplement to Service Manual T3 Telephones Connected to IP Office Copyright SHB_T3IP_IPO3.2_060428_en.doc 1 Copyright Copyright Copyright Avaya GmbH
www.voicesonic.com Phone: 877.289.2829 Administrator Guide SIP Cordless Phone Model No. KX-TGP500 KX-TGP550 Thank you for purchasing a Panasonic product. Please read this guide before using the unit and
IceWarp Unified Communications Reference Version 11.1 Published on 11/4/2014 Contents... 4 About... 5 The Big Picture... 7 Reference... 8 General... 8 Dial Plan... 9 Dial Plan Examples... 12 Devices...
Grandstream Networks, Inc. HT701/ HT702/HT704 Analog Telephone Adaptor HT701 HT702 HT704 HT70X USER MANUAL HT70X USER MANUAL INDEX GNU GPL INFORMATION... 5 CHANGE LOG... 6 CHANGES FROM 18.104.22.168 USER MANUAL...
11/2010 Versie 1 About This Guide Thank you for choosing the tiptel IP 28xs which is especially designed for power users in the office environment. It features fashionable and sleek design, abundant telephony
Avaya Solution & Interoperability Test Lab Application Notes for SIP Trunking Using Verizon Business IP Trunk SIP Trunk Service and Avaya IP Office Release 7.0 Issue 1.0 Abstract These Application Notes
IP 720 Phone User Manual October 2012 WARNING! Toll fraud is committed when individuals unlawfully gain access to customer telecommunication systems. This is a criminal offense. Currently, we do not know
ADMINISTRATION GUIDE Linksys Voice System SPA 900 Series IP Phones BUSINESS SERIES Contents Document Audience i-ix Related Documentation i-x Technical Support i-x CONTENTS CHAPTER 1 Introducing Linksys
IceWarp Unified Communications VoIP Service Reference Version 10.4 Printed on 13 April, 2012 Contents VoIP Service 1 Introduction... 1 The Big Picture... 4 Reference... 5 General... 5 Dial Plan... 7 Dial
Voice User Guide Model No. SPA3102 Copyright and Trademarks Specifications are subject to change without notice. Linksys is a registered trademark or trademark of Cisco Systems, Inc. and/or its affiliates
Grandstream Networks, Inc. HT503 FXS/FXO Port Analog Telephone Adaptor HT503 User Manual Firmware Version 22.214.171.124 www.grandstream.com firstname.lastname@example.org TABLE OF CONTENTS HT503 USER MANUAL WELCOME...
MFT Platform Server for Windows User Guide Version 7.1 September 28, 2011 Important Information MFT Platform Server for Windows Important Information SOME TIBCO SOFTWARE EMBEDS OR BUNDLES OTHER TIBCO SOFTWARE.
VoIP Gateway Ethernet VoiceGate ATA User s Guide rev. 1.0 10/2007 2 VoIP lines VoIP Gateway Configuration 1.0 Features Network Protocol SIP v1 (RFC2543), v2(rfc3261) IP/TCP/UDP/RTP/RTCP IP/ICMP/ARP/RARP/SNTP
IP Networking Guide Pure IP-PBX Model No. KX-TDE100 KX-TDE200/KX-TDE600 Thank you for purchasing a Panasonic Pure IP-PBX. Please read this manual carefully before using this product and save this manual
4610SW IP Telephone User Guide 555-233-784 Issue 3 April 2006 2006 Avaya Inc. All Rights Reserved. Notice While reasonable efforts were made to ensure that the information in this document was complete