Multimedia Communication in the Internet. SIP: Advanced Topics. Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Multimedia Communication in the Internet. SIP: Advanced Topics. Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS"

Transcription

1 Multimedia Communication in the Internet SIP: Advanced Topics Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS

2 SIP and NAT

3 NAT Concept NAT = Network Address Translation Share one IP address among many hosts Conceal internal structure of intranet NAT solution to map between private and public addresses Scenarios IP Company with an address block of insufficient size Private DSL line sharing : : :80 NAT :20080

4 NAT Classification RFC 2663: IP NAT Terminology and Considerations Full Cone Restricted Cone Port Restricted Cone Symmetric NAT Generally dynamic mappings for a short time Contact Source User Client Contact Target

5 Full Cone NAT Mappings well established A: P:20100 A: P:8000 A: P:12000

6 Full Cone NAT Mappings well established Connection from public Internet possible if mapping known A: P:20200 A: P:20100 A: P:8000 A: P:12000

7 Restricted NAT Mappings established on client request A: P:20100 A: P:8000 A: P:12000

8 Restricted NAT Mappings established through client connection Connection from public Internet only possible after client request A: P:20200 A: P:20100 A: P:8000 A: P:12000

9 Restricted NAT Mappings established through client connection Connection from public Internet only possible after client request Port Restricted NAT applies also to different ports on same host! P:20100 P:20101 A: P:8000 A: P:12000

10 Symmetric NAT Mappings depend on target IP Every new target establishes a new mapping Connection from public Internet only possible after client request P:12000 P:12001 A: P:20200 A: P:20100 A: P:8000 A:

11 SIP Traffic Flow Signaling Protocol Media Transport End Users Call Server End Users IP Router Signaling and Media traffic might pass different hosts

12 SIP Through NAT UA1 NAT Proxy UA IPSRC :5060 IP Source with Port INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4 SIP Message with SDP

13 SIP Through NAT UA1 NAT Proxy UA ? IPSRC :5060 INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4 IPSRC :1234 INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4

14 SIP Through NAT UA1 NAT Proxy UA ? IPSRC :1234 INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4 IPSRC :1234 INVITE Via: SIP/2.0/UDP :5060; \ received: ;rport:1234 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4

15 SIP Through NAT UA1 NAT Proxy UA ? IPSRC :1234 INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4 IPSRC :5060 INVITE Via: SIP/2.0/UDP :5060 Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4

16 SIP / NAT Problems Signaling traffic Routing back to the NATed UA Future requests to a NATed contact Media Traffic Payload SDP address does not match contact address And more!

17 SIP NAT Solutions Messages have to be altered to reflect present address Responsibility of NAT or UA? NAT: Application Layer Gateway Needs access to the NAT / firewall Needs special configuration Cascading NATs? UA Needs enhanced UAs Needs means to detect real IP Query NAT, e.g. UPnP Query external Server, e.g. STUN Can recognize cascading NAT

18 NAT + ALG UA1 NAT+ALG Proxy UA INVITE Via: SIP/2.0/UDP :5060 Contact: Content-Type: application/sdp c=in IP m=audio 8000 RTP/AVP 4 INVITE Via: SIP/2.0/UDP :1234 Contact: Content-Type: application/sdp c=in IP m=audio 3456 RTP/AVP 4

19 STUN Simple Traversal of UDP Through NATs RFC 3489 Simple client-server protocol Detects type of NAT used and public visible addresses Does not work with Symmetric NATs!... Client NAT's STUN server Public Address Space

20 SIP with STUN STUN UA1 NAT Proxy UA use STUN to find out public RTP address: c=in IP c=in IP m=audio 8000 RTP/AVP 4 m=audio 3456 RTP/AVP 4

21 NAT and RTP Symmetric NAT client cannot detect its public address with a NAT probe Different types of NAT need to send traffic before they can receive traffic (Port) Restricted NAT, symmetric NAT Connection Oriented Media Send before receive What if both UA's are behind a restricted NAT? RTP Proxy / Relay Intermediate RTP connection between two Uas Located in public Internet

22 RTP Relay DeltaThree 1) UA sends INVITE to proxy 2) Proxy contacts Relay to setup RTP session 3) Relay assigns Port and forwards it to proxy 4) Proxy modifies SDP and forwards this to destination

23 RTP Relay DeltaThree 5) OK from destination with its own SDP 6) Proxy delivers SDP information to relay (or instructs to setup a new session if destination is also behind symmetric NAT) 7) Relay informs proxy of new port 8) Proxy forwards OK to UA with modified SDP

24 RTP Relay DeltaThree 9) RTP traffic to RTP relay 10)Relay notes first incoming packet for further use 11)Destination sends RTP 12)RTP traffic is sent to address captured in 10)

25 NAT Summary SIP and NAT are not meant for each other! NAT won't disappear in the short term IPv6 still not deployed yet No standardized NAT established Workaround for SIP exist, but it's no perfect solution Signaling information has to be patched Media information has to be patched Media traffic needs to be relayed

26 SIP Security

27 Security Services Availability subject to Denial of Service Attacks: burdening servers with enormous load, uploading hostile applications, physical violence difficult to beat: self vs. non-self problem Authorization prevents unauthorized persons from inspection of both signaling and media can be solved using encryption problems: encryption computationally expensive; key exchange protocols needed; no PKI available Authentication, Accounting

28 Disclaimers & Problems Disclaimer #1: Protocol security is only a piece of the big picture; security of a system may always be compromised by naive implementation or administration. Disclaimer #2: Security of a single protocol does not help; all participating protocols have to be made secure. Disclaimer #3: Physical security counts as well!!! Disclaimer #4: Security protocols cannot solve social-layer issues.

29 SIP Security Tools Need to protect registrations User A should not be allowed to register as user B Need to protect service usage User A should not be allowed to use the PSTN gateway Need to ensure the identity of the server Avoid contacting insecure servers Need to secure content Do not allow servers to manipulate content not meant for them

30 Policy Based Security Authenticate the user only for certain services Calling another VoIP user is free of charge No need for authentication Calling an ISDN user is not free Authenticate the user first Require am authentication, authorization and accounting server for: Maintaining information about the user s Privileges Account information Used resources Request Proxy AAA PSTN GW

31 SIP Digest Authentication Required for user identification and admission control for services. Based on HTTP Digest (RFC2617) Sender: Sends Realm, Nonce (with optional timestamp embedding) User: generates Hash over User, Realm, Password, Method, Request URI If Hash at server match, access is granted Hash: Algorithm generating small output One way generation Collision resistant Computationally simple Request Challenge (nonce,realm) ACK Request w/credentials

32 Message Security Users can encrypt the content of their messages to prevent SIP proxies from reading or changing the content Can only encrypt parts that are not used by proxies VIA, RecordRoute,... Encryption might prevent some functions Firewall / NAT traversal Hop-by-Hop Signaling Security requires belief in transitive trust immense computational stress on servers if public-key used can deal with firewalls/nats may cover entire signaling mechanisms: ipsec, TLS Combination of both may be used Keying: no established solution

33 Media Security Encryption of media content May take place either at IP or RTP layer Performance overhead considerable No established solutions for keying

34 Social Issues! SIP INVITE w/jpeg INVITE SIP/2.0 Via: SIP/2.0/UDP here.com:5060 From: BigGuy To: LittleGuy Call-ID: 200 OK w/jpeg SIP/ OK Via: SIP/2.0/UDP here.com:5060 From: BigGuy To: LittleGuy Call-ID:

35 Peering & Inter- Provider Security General: To reach a wider user population providers need to cooperate, however IP-Technology offers various attack possibilities and security holes Use chained trust relations Provider A authenticates and authorizes his users Provider A has a trust relation with provider B All requests arriving on the secure tunnel are trusted Secure tunnels established using TLS Similar to web security A and B exchange certificates which are authenticated either directly or through a third trusted party Example would like to call to PSTN through his gateway operator which telephone number to display at the receiver? Proxies need to link SIP address to a phone number Remote party ID Fun: Allow for distinctive ringing Not trusted calls have a distinctive ringing at the receiver

36 Object 1 Remote Party ID (RPID) User ID/phone number database INVITE From: To: a INVITE From: To: Remote-Party-ID: PSTN SER with RPID support PSTN gateway

37 Problem of Trust Displaying proper caller ID is a legal requirement for operators. What happens if someone fakes the RPID and operator displays a wrong number? Gateway should only display caller ID issued by a trustworthy source. Trust needed to solve other problems too: Does the call come from a source to whom my gateway can credit international calls? Establishing trust to individual users within a single domain almost easy but what if multiple domains comes in?

38 TLS Use for Interdomain Security Internet PSTN #1 #2 TLS Originating domain Public Internet Assumption: target domain trusts source domain to display proper CallerID and settle incurred costs. Step 1: originating domain verifies identity of local user (digest). If ok, it appends RPID and uses TLS for secure inter-domain communication. Step 2: terminating proxy verifies incoming TLS connection against list of trustworthy domains. If ok, SIP request is forwarded to PSTN gateway

39 More on TLS TLS use for SIP solves other trust problems too: With trust mechanisms, interdomain accounting can be also implemented securely Signaling can be no longer sniffed during transport. Security Disclaimers: Trust established hop-by-hop it implies transitive trust along arbitrarily long proxy chains. Remember a chains is as strong as the weakest element in it. You have to trust next-hop not to pass your requests to questionable servers. Privacy is not end-to-end: proxy servers along the signaling path do see SIP in plain-text.

Multimedia Communication in the Internet. SIP Security Threats. Sven Ehlert Next Generation Network Infrastructure Fraunhofer FOKUS 1

Multimedia Communication in the Internet. SIP Security Threats. Sven Ehlert Next Generation Network Infrastructure Fraunhofer FOKUS 1 Multimedia Communication in the Internet SIP Security Threats Sven Ehlert Next Generation Network Infrastructure Fraunhofer FOKUS 1 Outline SIP Security Mechanisms Denial of Service VoIP SPAM 2 SIP Call

More information

The Purpose of a SIP-Aware Firewall/ALG

The Purpose of a SIP-Aware Firewall/ALG NetVanta Unified Communications Technical Note The Purpose of a SIP-Aware Firewall/ALG Introduction This technical note will explore the purpose of a Session Initiation Protocol (SIP)-aware firewall/application

More information

VoIP LAB. 陳 懷 恩 博 士 助 理 教 授 兼 所 長 國 立 宜 蘭 大 學 資 訊 工 程 研 究 所 Email: wechen@niu.edu.tw TEL: 03-9357400 # 255

VoIP LAB. 陳 懷 恩 博 士 助 理 教 授 兼 所 長 國 立 宜 蘭 大 學 資 訊 工 程 研 究 所 Email: wechen@niu.edu.tw TEL: 03-9357400 # 255 SIP Traversal over NAT 陳 懷 恩 博 士 助 理 教 授 兼 所 長 國 立 宜 蘭 大 學 資 訊 工 程 研 究 所 Email: wechen@niu.edu.tw TEL: 03-9357400 # 255 Outline Introduction to SIP and NAT NAT Problem Definition NAT Solutions on NTP VoIP

More information

SIP and PSTN Connectivity. Jiri Kuthan, iptel.org sip:jiri@iptel.org September 2003

SIP and PSTN Connectivity. Jiri Kuthan, iptel.org sip:jiri@iptel.org September 2003 SIP and PSTN Connectivity Jiri Kuthan, iptel.org sip:jiri@iptel.org September 2003 Outline PSTN Gateways. PSTN2IP Demo Integration challenges: CLID Interdomain Trust Gateway Location Outlook: Reuse of

More information

Multimedia Communication in the Internet. SIP Security Threads. Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS 1

Multimedia Communication in the Internet. SIP Security Threads. Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS 1 Multimedia Communication in the Internet SIP Security Threads Dorgham Sisalem, Sven Ehlert Mobile Integrated Services FhG FOKUS 1 Denial of Service Prevent service availability Software vulnerabilities

More information

NAT TCP SIP ALG Support

NAT TCP SIP ALG Support The feature allows embedded messages of the Session Initiation Protocol (SIP) passing through a device that is configured with Network Address Translation (NAT) to be translated and encoded back to the

More information

ARCHITECTURES TO SUPPORT PSTN SIP VOIP INTERCONNECTION

ARCHITECTURES TO SUPPORT PSTN SIP VOIP INTERCONNECTION ARCHITECTURES TO SUPPORT PSTN SIP VOIP INTERCONNECTION 10 April 2009 Gömbös Attila, Horváth Géza About SIP-to-PSTN connectivity 2 Providing a voice over IP solution that will scale to PSTN call volumes,

More information

Voice over IP (SIP) Milan Milinković milez@sbox.tugraz.at 30.03.2007.

Voice over IP (SIP) Milan Milinković milez@sbox.tugraz.at 30.03.2007. Voice over IP (SIP) Milan Milinković milez@sbox.tugraz.at 30.03.2007. Intoduction (1990s) a need for standard protocol which define how computers should connect to one another so they can share media and

More information

The SIP-Based System Used in Connection with a Firewall

The SIP-Based System Used in Connection with a Firewall The SIP-Based System Used in Connection with a Firewall Peter Koski, Jorma Ylinen, Pekka Loula Tampere University of Technology, Pori Pohjoisranta 11 A, P.O.Box 300, FIN-28101 Pori,Finland peter.koski@tut.fi,

More information

Communication Systems SIP

Communication Systems SIP Communication Systems SIP Computer Science Organization I. Data and voice communication in IP networks II. Security issues in networking III. Digital telephony networks and voice over IP 2 Part 3 Digital,

More information

NTP VoIP Platform: A SIP VoIP Platform and Its Services

NTP VoIP Platform: A SIP VoIP Platform and Its Services NTP VoIP Platform: A SIP VoIP Platform and Its Services Speaker: Dr. Chai-Hien Gan National Chiao Tung University, Taiwan Email: chgan@csie.nctu.edu.tw Date: 2006/05/02 1 Outline Introduction NTP VoIP

More information

Authentication and Authorisation for Integrated SIP Services in Heterogeneous Environments 1

Authentication and Authorisation for Integrated SIP Services in Heterogeneous Environments 1 Authentication and Authorisation for Integrated SIP Services in Heterogeneous Environments 1 Dorgham Sisalem, Jiri Kuthan Fraunhofer Institute for Open Communication Systems (FhG Fokus) Kaiserin-Augusta-Allee

More information

Media Gateway Controller RTP

Media Gateway Controller RTP 1 Softswitch Architecture Interdomain protocols Application Server Media Gateway Controller SIP, Parlay, Jain Application specific Application Server Media Gateway Controller Signaling Gateway Sigtran

More information

Voice over IP & Other Multimedia Protocols. SIP: Session Initiation Protocol. IETF service vision. Advanced Networking

Voice over IP & Other Multimedia Protocols. SIP: Session Initiation Protocol. IETF service vision. Advanced Networking Advanced Networking Voice over IP & Other Multimedia Protocols Renato Lo Cigno SIP: Session Initiation Protocol Defined by IETF RFC 2543 (first release march 1999) many other RFCs... see IETF site and

More information

NAT Traversal for VoIP

NAT Traversal for VoIP NAT Traversal for VoIP Dr. Quincy Wu National Chi Nan University Email: solomon@ipv6.club.tw 1 TAC2000/2000 NAT Traversal Where is NAT What is NAT Types of NAT NAT Problems NAT Solutions Program Download

More information

SIP: NAT and FIREWALL TRAVERSAL Amit Bir Singh Department of Electrical Engineering George Washington University

SIP: NAT and FIREWALL TRAVERSAL Amit Bir Singh Department of Electrical Engineering George Washington University SIP: NAT and FIREWALL TRAVERSAL Amit Bir Singh Department of Electrical Engineering George Washington University ABSTRACT The growth of market for real-time IP communications is a big wave prevalent in

More information

Denial of Services on SIP VoIP infrastructures

Denial of Services on SIP VoIP infrastructures Denial of Services on SIP VoIP infrastructures Ge Zhang Karlstad University ge.zhang@kau.se 1 Outline Background Denial of Service attack using DNS Conclusion 2 VoIP What is VoIP? What is its advantage?

More information

NAT Traversal in SIP. Baruch Sterman, Ph.D. Chief Scientist baruch@deltathree.com. David Schwartz Director, Telephony Research davids@deltathree.

NAT Traversal in SIP. Baruch Sterman, Ph.D. Chief Scientist baruch@deltathree.com. David Schwartz Director, Telephony Research davids@deltathree. Baruch Sterman, Ph.D. Chief Scientist baruch@deltathree.com David Schwartz Director, Telephony Research davids@deltathree.com Table of Contents 2 3 Background Types of Full Cone Restricted Cone Port Restricted

More information

Application Note. Firewall Requirements for the Onsight Mobile Collaboration System and Hosted Librestream SIP Service v5.0

Application Note. Firewall Requirements for the Onsight Mobile Collaboration System and Hosted Librestream SIP Service v5.0 Application Note Firewall Requirements for the Onsight Mobile Collaboration System and Hosted Librestream SIP Service v5.0 1 FIREWALL REQUIREMENTS FOR ONSIGHT MOBILE VIDEO COLLABORATION SYSTEM AND HOSTED

More information

Real-Time Traffic. Requirements of real-time traffic differ from those of high-speed but non-real-time traffic.

Real-Time Traffic. Requirements of real-time traffic differ from those of high-speed but non-real-time traffic. Real-Time Traffic The widespread deployment of high-speed LANs and WANs and the increase in the line capacity on the Internet and other internets has opened up the possibility of using IP-based networks

More information

Application Note. Onsight Connect Network Requirements V6.1

Application Note. Onsight Connect Network Requirements V6.1 Application Note Onsight Connect Network Requirements V6.1 1 ONSIGHT CONNECT SERVICE NETWORK REQUIREMENTS... 3 1.1 Onsight Connect Overview... 3 1.2 Onsight Connect Servers... 4 Onsight Connect Network

More information

How to make free phone calls and influence people by the grugq

How to make free phone calls and influence people by the grugq VoIPhreaking How to make free phone calls and influence people by the grugq Agenda Introduction VoIP Overview Security Conclusion Voice over IP (VoIP) Good News Other News Cheap phone calls Explosive growth

More information

Advanced Networking Voice over IP & Other Multimedia Protocols

Advanced Networking Voice over IP & Other Multimedia Protocols Advanced Networking Voice over IP & Other Multimedia Protocols Renato Lo Cigno SIP: Session Initiation Protocol Defined by IETF RFC 2543 (first release march 1999) many other RFCs... see IETF site and

More information

AV@ANZA Formación en Tecnologías Avanzadas

AV@ANZA Formación en Tecnologías Avanzadas SISTEMAS DE SEÑALIZACION SIP I & II (@-SIP1&2) Contenido 1. Why SIP? Gain an understanding of why SIP is a valuable protocol despite competing technologies like ISDN, SS7, H.323, MEGACO, SGCP, MGCP, and

More information

SIP Security. ENUM-Tag am 28. September in Frankfurt. Prof. Dr. Andreas Steffen. Agenda. andreas.steffen@zhwin.ch

SIP Security. ENUM-Tag am 28. September in Frankfurt. Prof. Dr. Andreas Steffen. Agenda. andreas.steffen@zhwin.ch ENUM-Tag am 28. September in Frankfurt SIP Security Prof. Dr. Andreas Steffen andreas.steffen@zhwin.ch Andreas Steffen, 28.09.2004, ENUM_SIP.ppt 1 Agenda SIP The Session Initiation Protocol Securing the

More information

VoIP some threats, security attacks and security mechanisms. Lars Strand RiskNet Open Workshop Oslo, 24. June 2009

VoIP some threats, security attacks and security mechanisms. Lars Strand RiskNet Open Workshop Oslo, 24. June 2009 VoIP some threats, security attacks and security mechanisms Lars Strand RiskNet Open Workshop Oslo, 24. June 2009 "It's appalling how much worse VoIP is compared to the PSTN. If these problems aren't fixed,

More information

SIP OVER NAT. Pavel Segeč. University of Žilina, Faculty of Management Science and Informatics, Slovak Republic e-mail: Pavel.Segec@fri.uniza.

SIP OVER NAT. Pavel Segeč. University of Žilina, Faculty of Management Science and Informatics, Slovak Republic e-mail: Pavel.Segec@fri.uniza. SIP OVER NAT Pavel Segeč University of Žilina, Faculty of Management Science and Informatics, Slovak Republic e-mail: Pavel.Segec@fri.uniza.sk Abstract Session Initiation Protocol is one of key IP communication

More information

3.1 SESSION INITIATION PROTOCOL (SIP) OVERVIEW

3.1 SESSION INITIATION PROTOCOL (SIP) OVERVIEW 3.1 SESSION INITIATION PROTOCOL (SIP) OVERVIEW SIP is an application layer protocol that is used for establishing, modifying and terminating multimedia sessions in an Internet Protocol (IP) network. SIP

More information

SIP ALG - Session Initiated Protocol Applications- Level Gateway

SIP ALG - Session Initiated Protocol Applications- Level Gateway SIP ALG is a parameter that is generally enabled on most commercial router because it helps to resolve NAT related problems. However, this parameter can be very harmful and can actually stop SIP Trunks

More information

Session Initiation Protocol (SIP) 陳 懷 恩 博 士 助 理 教 授 兼 計 算 機 中 心 資 訊 網 路 組 組 長 國 立 宜 蘭 大 學 資 工 系 Email: wechen@niu.edu.tw TEL: 03-9357400 # 340

Session Initiation Protocol (SIP) 陳 懷 恩 博 士 助 理 教 授 兼 計 算 機 中 心 資 訊 網 路 組 組 長 國 立 宜 蘭 大 學 資 工 系 Email: wechen@niu.edu.tw TEL: 03-9357400 # 340 Session Initiation Protocol (SIP) 陳 懷 恩 博 士 助 理 教 授 兼 計 算 機 中 心 資 訊 網 路 組 組 長 國 立 宜 蘭 大 學 資 工 系 Email: wechen@niu.edu.tw TEL: 03-9357400 # 340 Outline Session Initiation Protocol SIP Extensions SIP Operation

More information

Knut Omang Ifi/Oracle 16 Nov, 2015

Knut Omang Ifi/Oracle 16 Nov, 2015 RT protocols and Firewall/NAT - SIP FW/NAT support in the Linux kernel Knut Omang Ifi/Oracle 16 Nov, 2015 32 Overview Quick overview of some protocols in use for real-time multimedia SIP/SDP Other protocols

More information

White paper. SIP An introduction

White paper. SIP An introduction White paper An introduction Table of contents 1 Introducing 3 2 How does it work? 3 3 Inside a normal call 4 4 DTMF sending commands in sip calls 6 5 Complex environments and higher security 6 6 Summary

More information

Part II. Prof. Ai-Chun Pang Graduate Institute of Networking and Multimedia, Dept. of Comp. Sci. and Info. Engr., National Taiwan University

Part II. Prof. Ai-Chun Pang Graduate Institute of Networking and Multimedia, Dept. of Comp. Sci. and Info. Engr., National Taiwan University Session Initiation Protocol oco (SIP) Part II Prof. Ai-Chun Pang Graduate Institute of Networking and Multimedia, Dept. of Comp. Sci. and Info. Engr., National Taiwan University Email: acpang@csie.ntu.edu.tw

More information

Application Note. Onsight TeamLink And Firewall Detect v6.3

Application Note. Onsight TeamLink And Firewall Detect v6.3 Application Note Onsight And Firewall Detect v6.3 1 ONSIGHT TEAMLINK HTTPS TUNNELING SERVER... 3 1.1 Encapsulation... 3 1.2 Firewall Detect... 3 1.2.1 Firewall Detect Test Server Options:... 5 1.2.2 Firewall

More information

Hacking Trust Relationships of SIP Gateways

Hacking Trust Relationships of SIP Gateways Hacking Trust Relationships of SIP Gateways Author : Fatih Özavcı Homepage : gamasec.net/fozavci SIP Project Page : github.com/fozavci/gamasec-sipmodules Version : 0.9 Hacking Trust Relationship Between

More information

VoIP and NAT/Firewalls: Issues, Traversal Techniques, and a Real-World Solution

VoIP and NAT/Firewalls: Issues, Traversal Techniques, and a Real-World Solution ACCEPTED FROM OPEN CALL VoIP and NAT/Firewalls: Issues, Traversal Techniques, and a Real-World Solution Hechmi Khlifi, Jean-Charles Grégoire, and James Phillips, Université du Québec ABSTRACT In spite

More information

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with

More information

SIP Basics. CSG VoIP Workshop. Dennis Baron January 5, 2005. Dennis Baron, January 5, 2005 Page 1. np119

SIP Basics. CSG VoIP Workshop. Dennis Baron January 5, 2005. Dennis Baron, January 5, 2005 Page 1. np119 SIP Basics CSG VoIP Workshop Dennis Baron January 5, 2005 Page 1 Outline What is SIP SIP system components SIP messages and responses SIP call flows SDP basics/codecs SIP standards Questions and answers

More information

SIP: Protocol Overview

SIP: Protocol Overview SIP: Protocol Overview NOTICE 2001 RADVISION Ltd. All intellectual property rights in this publication are owned by RADVISION Ltd. and are protected by United States copyright laws, other applicable copyright

More information

Best Practices for SIP Security

Best Practices for SIP Security Best Practices for SIP Security IMTC SIP Parity Group Version 21 November 9, 2011 Table of Contents 1. Overview... 33 2. Security Profile... 33 3. Authentication & Identity Protection... 33 4. Protecting

More information

User authentication in SIP

User authentication in SIP User authentication in SIP Pauli Vesterinen Helsinki University of Technology pjvester@cc.hut.fi Abstract Today Voice over Internet Protocol (VoIP) is used in large scale to deliver voice and multimedia

More information

The basics of multimedia exchange. VoIP and MultiMedia /50

The basics of multimedia exchange. VoIP and MultiMedia /50 The basics of multimedia exchange VoIP and MultiMedia 2012 emil.ivov@jitsi.org 1/50 Where did it all start? VoIP and MultiMedia 2012 emil.ivov@jitsi.org 2/50 The basics of IP telephony. network core (registrars,

More information

Firewall Support for SIP

Firewall Support for SIP Firewall Support for SIP The Firewall Support for SIP feature integrates Cisco IOS firewalls, Voice over IP (VoIP) protocol, and Session Initiation Protocol (SIP) within a Cisco IOS-based platform, enabling

More information

VOICE OVER IP SECURITY

VOICE OVER IP SECURITY VOICE OVER IP SECURITY February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

INTRODUCTION OF VOIP AND SIP SECURITY 2

INTRODUCTION OF VOIP AND SIP SECURITY 2 INTRODUCTION OF VOIP AND SIP SECURITY 2 Ge Zhang, Karlstad University May, 2009 Outline Review SIP vulnerabilities by external infrastructures DNS server as an example Confidentiality Integrity Availability

More information

NAT Traversal for VoIP. Ai-Chun Pang Graduate Institute of Networking and Multimedia Dept. of Comp. Sci. and Info. Engr. National Taiwan University

NAT Traversal for VoIP. Ai-Chun Pang Graduate Institute of Networking and Multimedia Dept. of Comp. Sci. and Info. Engr. National Taiwan University NAT Traversal for VoIP Ai-Chun Pang Graduate Institute of Networking and Multimedia Dept. of Comp. Sci. and Info. Engr. National Taiwan University 1 What is NAT NAT - Network Address Translation RFC 3022

More information

Network Convergence and the NAT/Firewall Problems

Network Convergence and the NAT/Firewall Problems Network Convergence and the NAT/Firewall Problems Victor Paulsamy Zapex Technologies, Inc. Mountain View, CA 94043 Samir Chatterjee School of Information Science Claremont Graduate University Claremont,

More information

Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme

Lehrstuhl für Informatik 4 Kommunikation und verteilte Systeme Chapter 2: Representation of Multimedia Data Chapter 3: Multimedia Systems Communication Aspects and Services Multimedia Applications and Communication Protocols Quality of Service and Resource Management

More information

Chapter 10 Session Initiation Protocol. Prof. Yuh-Shyan Chen Department of Computer Science and Information Engineering National Taipei University

Chapter 10 Session Initiation Protocol. Prof. Yuh-Shyan Chen Department of Computer Science and Information Engineering National Taipei University Chapter 10 Session Initiation Protocol Prof. Yuh-Shyan Chen Department of Computer Science and Information Engineering National Taipei University Outline 12.1 An Overview of SIP 12.2 SIP-based GPRS Push

More information

SIP, Session Initiation Protocol used in VoIP

SIP, Session Initiation Protocol used in VoIP SIP, Session Initiation Protocol used in VoIP Page 1 of 9 Secure Computer Systems IDT658, HT2005 Karin Tybring Petra Wahlund Zhu Yunyun Table of Contents SIP, Session Initiation Protocol...1 used in VoIP...1

More information

OSSIR, November 2010 emil.ivov@sip-communicator.org 1/45

OSSIR, November 2010 emil.ivov@sip-communicator.org 1/45 OSSIR, November 2010 emil.ivov@sip-communicator.org 1/45 Real-time Communication Applications OSSIR, November 2010 emil.ivov@sip-communicator.org 2/45 Protocols sip & xmpp OSSIR, November 2010 emil.ivov@sip-communicator.org

More information

SIP: Session Initiation Protocol

SIP: Session Initiation Protocol SIP: Session Initiation Protocol http://network.hanbat.ac.kr Reference: www.cisco.com/ipj march 2003 Introduction The Session Initiation Protocol (SIP), defined in RFC 3261[6], is an application level

More information

VoIP. What s Voice over IP?

VoIP. What s Voice over IP? VoIP What s Voice over IP? Transmission of voice using IP Analog speech digitized and transmitted as IP packets Packets transmitted on top of existing networks Voice connection is now packet switched as

More information

IP-Telephony SIP & MEGACO

IP-Telephony SIP & MEGACO IP-Telephony SIP & MEGACO Bernard Hammer Siemens AG, Munich Siemens AG 2001 1 Presentation Outline Session Initiation Protocol Introduction Examples Media Gateway Decomposition Protocol 2 IETF Standard

More information

Implementing Cisco Unified Communications Security (UCSECv1.0)

Implementing Cisco Unified Communications Security (UCSECv1.0) Implementing Cisco Unified Communications Security (UCSECv1.0) Course Objectives Identify vulnerabilities in Cisco Unified Communications networks and describe security strategies, cryptographic services,

More information

Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany

Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany Service Provider implementation of SIP regarding security Vesselin Tzvetkov, Holger Zuleger {vesselin.tzvetkov, holger.zuleger}@arcor.net Arcor AG&Co KG, Alfred-Herrhausen-Allee 1, 65760 Eschborn, Germany

More information

Anat Bremler-Barr Ronit Halachmi-Bekel Jussi Kangasharju Interdisciplinary center Herzliya Darmstadt University of Technology

Anat Bremler-Barr Ronit Halachmi-Bekel Jussi Kangasharju Interdisciplinary center Herzliya Darmstadt University of Technology Unregister Attack in SIP Anat Bremler-Barr Ronit Halachmi-Bekel Jussi Kangasharju Interdisciplinary center Herzliya Darmstadt University of Technology Unregister Attack We present a new VoIP Denial Of

More information

SIP Essentials Training

SIP Essentials Training SIP Essentials Training 5 Day Course Lecture & Labs COURSE DESCRIPTION Learn Session Initiation Protocol and important protocols related to SIP implementations. Thoroughly study the SIP protocol through

More information

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Virtual private network Network security protocols COMP347 2006 Len Hamey Instead of a dedicated data link Packets securely sent over a shared network Internet VPN Public internet Security protocol encrypts

More information

Internet Working 15th lecture (last but one) Chair of Communication Systems Department of Applied Sciences University of Freiburg 2005

Internet Working 15th lecture (last but one) Chair of Communication Systems Department of Applied Sciences University of Freiburg 2005 15th lecture (last but one) Chair of Communication Systems Department of Applied Sciences University of Freiburg 2005 1 43 administrational stuff Next Thursday preliminary discussion of network seminars

More information

Analysis of a VoIP Attack

Analysis of a VoIP Attack IPCom Gesellschaft für internetbasierte Kommunikationsdienste mbh Analysis of a VoIP Attack Klaus Darilion, IPCom GmbH, klaus.darilion@ipcom.at Abstract: Recently, several IT news websites reported VoIP

More information

SIP and VoIP 1 / 44. SIP and VoIP

SIP and VoIP 1 / 44. SIP and VoIP What is SIP? What s a Control Channel? History of Signaling Channels Signaling and VoIP Complexity Basic SIP Architecture Simple SIP Calling Alice Calls Bob Firewalls and NATs SIP URIs Multiple Proxies

More information

Voice over IP: Unsafe at any Bandwidth?

Voice over IP: Unsafe at any Bandwidth? Universität Hamburg Voice over IP: Unsafe at any Bandwidth? Joachim Posegga svs-office@informatik.uni-hamburg.de Fachbereich Informatik SVS Sicherheit in Verteilten Systemen VoIP Security: Agenda 1. PSTN

More information

802.11: Mobility Within Same Subnet

802.11: Mobility Within Same Subnet What is Mobility? Spectrum of mobility, from the perspective: no mobility high mobility mobile wireless user, using same AP mobile user, (dis) connecting from using DHCP mobile user, passing through multiple

More information

Avaya IP Office 4.0 Customer Configuration Guide SIP Trunking Configuration For Use with Cbeyond s BeyondVoice with SIPconnect Service

Avaya IP Office 4.0 Customer Configuration Guide SIP Trunking Configuration For Use with Cbeyond s BeyondVoice with SIPconnect Service Avaya IP Office 4.0 Customer Configuration Guide SIP Trunking Configuration For Use with Cbeyond s BeyondVoice with SIPconnect Service Issue 2.2 06/25/2007 Page 1 of 41 Table of contents 1 Introduction...8

More information

Request for Comments: 4579. August 2006

Request for Comments: 4579. August 2006 Network Working Group Request for Comments: 4579 BCP: 119 Category: Best Current Practice A. Johnston Avaya O. Levin Microsoft Corporation August 2006 Status of This Memo Session Initiation Protocol (SIP)

More information

Application Notes for Configuring SIP Trunking between McLeodUSA SIP Trunking Solution and an Avaya IP Office Telephony Solution 1.

Application Notes for Configuring SIP Trunking between McLeodUSA SIP Trunking Solution and an Avaya IP Office Telephony Solution 1. Avaya Solution & Interoperability Test Lab Application Notes for Configuring SIP Trunking between McLeodUSA SIP Trunking Solution and an Avaya IP Office Telephony Solution 1.0 Abstract These Application

More information

Session Initiation Protocol (SIP) The Emerging System in IP Telephony

Session Initiation Protocol (SIP) The Emerging System in IP Telephony Session Initiation Protocol (SIP) The Emerging System in IP Telephony Introduction Session Initiation Protocol (SIP) is an application layer control protocol that can establish, modify and terminate multimedia

More information

VoIP technology employs several network protocols such as MGCP, SDP, H323, SIP.

VoIP technology employs several network protocols such as MGCP, SDP, H323, SIP. 1 VoIP support configuration First used in the mid-1990s, VoIP is an emerging technology for telephone calls and other data transfer. The concept is relatively simple: Use the multiple networks that comprise

More information

Adaptation of TURN protocol to SIP protocol

Adaptation of TURN protocol to SIP protocol IJCSI International Journal of Computer Science Issues, Vol. 7, Issue 1, No. 2, January 2010 ISSN (Online): 1694-0784 ISSN (Print): 1694-0814 78 Adaptation of TURN protocol to SIP protocol Mustapha GUEZOURI,

More information

EE4607 Session Initiation Protocol

EE4607 Session Initiation Protocol EE4607 Session Initiation Protocol Michael Barry michael.barry@ul.ie william.kent@ul.ie Outline of Lecture IP Telephony the need for SIP Session Initiation Protocol Addressing SIP Methods/Responses Functional

More information

Voice over IP (VoIP) Part 2

Voice over IP (VoIP) Part 2 Kommunikationssysteme (KSy) - Block 5 Voice over IP (VoIP) Part 2 Dr. Andreas Steffen 1999-2001 A. Steffen, 10.12.2001, KSy_VoIP_2.ppt 1 H.323 Network Components Terminals, gatekeepers, gateways, multipoint

More information

Three-Way Calling using the Conferencing-URI

Three-Way Calling using the Conferencing-URI Three-Way Calling using the Conferencing-URI Introduction With the deployment of VoIP users expect to have the same functionality and features that are available with a landline phone service. This document

More information

The H.323 NAT/FW Traversal Solution

The H.323 NAT/FW Traversal Solution Open Community Specification The H.323 NAT/FW Traversal Solution January 2014 International Multimedia Communications Consortium Summary This document describes the NAT/FW traversal solution defined by

More information

TECHNICAL CHALLENGES OF VoIP BYPASS

TECHNICAL CHALLENGES OF VoIP BYPASS TECHNICAL CHALLENGES OF VoIP BYPASS Presented by Monica Cultrera VP Software Development Bitek International Inc 23 rd TELELCOMMUNICATION CONFERENCE Agenda 1. Defining VoIP What is VoIP? How to establish

More information

Transparent weaknesses in VoIP

Transparent weaknesses in VoIP Transparent weaknesses in VoIP Peter Thermos peter.thermos@palindrometech.com 2007 Palindrome Technologies, All Rights Reserved 1 of 56 Speaker Background Consulting Government and commercial organizations,

More information

Session Initiation Protocol (SIP)

Session Initiation Protocol (SIP) SIP: Session Initiation Protocol Corso di Applicazioni Telematiche A.A. 2006-07 Lezione n.7 Ing. Salvatore D Antonio Università degli Studi di Napoli Federico II Facoltà di Ingegneria Session Initiation

More information

A Scalable Multi-Server Cluster VoIP System

A Scalable Multi-Server Cluster VoIP System A Scalable Multi-Server Cluster VoIP System Ming-Cheng Liang Li-Tsung Huang Chun-Zer Lee Min Chen Chia-Hung Hsu mcliang@nuk.edu.tw {kpa.huang, chunzer.lee}@gmail.com {minchen, chhsu}@nchc.org.tw Department

More information

TLS and SRTP for Skype Connect. Technical Datasheet

TLS and SRTP for Skype Connect. Technical Datasheet TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security

More information

IBM. Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise. zenterprise System. SC Level 01b

IBM. Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise. zenterprise System. SC Level 01b IBM zenterprise System Integrating the Hardware Management Console s Broadband Remote Support Facility into your Enterprise SC28-6927-01 IBM zenterprise System Integrating the Hardware Management Console

More information

SIP. Outline. Introduction SIP architecture SIP messages Session establishment exemples Registration

SIP. Outline. Introduction SIP architecture SIP messages Session establishment exemples Registration SIP Nguyen Thi Mai Trang LIP6/PHARE Thi-Mai-Trang.Nguyen@lip6.fr UPMC/PUF - M2 Networks - PTEL 1 Outline Introduction SIP architecture SIP messages Session establishment exemples Registration UPMC/PUF

More information

SIP Introduction. Jan Janak

SIP Introduction. Jan Janak SIP Introduction Jan Janak SIP Introduction by Jan Janak Copyright 2003 FhG FOKUS A brief overview of SIP describing all important aspects of the Session Initiation Protocol. Table of Contents 1. SIP Introduction...

More information

Adding Multi-Homing and Dual-Stack Support to the Session Initiation Protocol

Adding Multi-Homing and Dual-Stack Support to the Session Initiation Protocol Adding Multi-Homing and Dual-Stack Support to the Session Initiation Protocol Mario Baldi, Fulvio Risso, Livio Torrero Dipartimento di Automatica e Informatica, Politecnico di Torino, Torino, Italy {mario.baldi,

More information

Security Issues of SIP

Security Issues of SIP Master Thesis Electrical Engineering Thesis no: MEE10:74 June 2010 BLEKINGE INSTITUTE OF TECHNOLOGY SCHOOL OF ENGINEERING DEPARTMENT OF TELECOMMUNICATION SYSTEMS Security Issues of SIP MASTER S THESIS

More information

Application Note. Onsight Connect Network Requirements v6.3

Application Note. Onsight Connect Network Requirements v6.3 Application Note Onsight Connect Network Requirements v6.3 APPLICATION NOTE... 1 ONSIGHT CONNECT NETWORK REQUIREMENTS V6.3... 1 1 ONSIGHT CONNECT SERVICE NETWORK REQUIREMENTS... 3 1.1 Onsight Connect Overview...

More information

A Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method.

A Brief Overview of VoIP Security. By John McCarron. Voice of Internet Protocol is the next generation telecommunications method. A Brief Overview of VoIP Security By John McCarron Voice of Internet Protocol is the next generation telecommunications method. It allows to phone calls to be route over a data network thus saving money

More information

NAT and Firewall Traversal with STUN / TURN / ICE

NAT and Firewall Traversal with STUN / TURN / ICE NAT and Firewall Traversal with STUN / TURN / ICE Simon Perreault Viagénie {mailto sip}:simon.perreault@viagenie.ca http://www.viagenie.ca Credentials Consultant in IP networking and VoIP at Viagénie.

More information

Session Initiation Protocol

Session Initiation Protocol TECHNICAL OVERVIEW Session Initiation Protocol Author: James Wright, MSc This paper is a technical overview of the Session Initiation Protocol and is designed for IT professionals, managers, and architects

More information

Using Application-Level Gateways with NAT

Using Application-Level Gateways with NAT This module describes the basic tasks to configure an application-level gateway (ALG) with Network Address Translation (NAT). This module also provides information about the protocols that use ALGs for

More information

Secure Text in SIP Based VoIP

Secure Text in SIP Based VoIP MASTER S THESIS 2005:183 CIV Secure Text in SIP Based VoIP JOHAN KULTTI MASTER OF SCIENCE PROGRAMME Computer Science Luleå University of Technology Department of Computer Science and Electrical Engineering

More information

internet technologies and standards

internet technologies and standards Institute of Telecommunications Warsaw University of Technology 2015 internet technologies and standards Piotr Gajowniczek Andrzej Bąk Michał Jarociński multimedia in the Internet Voice-over-IP multimedia

More information

Connecting with Free IP Call

Connecting with Free IP Call Connecting with Free IP Call Free IP Call (http://www.freeipcall.com/) offers telephone service using the VoIP standard SIP. The service allow users making/receiving VoIP calls to/from VoIP telephone numbers

More information

Configuring SIP Support for SRTP

Configuring SIP Support for SRTP Configuring SIP Support for SRTP This chapter contains information about the SIP Support for SRTP feature. The Secure Real-Time Transfer protocol (SRTP) is an extension of the Real-Time Protocol (RTP)

More information

Based on the VoIP Example 1(Basic Configuration and Registration), we will introduce how to dial the VoIP call through an encrypted VPN tunnel.

Based on the VoIP Example 1(Basic Configuration and Registration), we will introduce how to dial the VoIP call through an encrypted VPN tunnel. 30. VoIP Example 3 (VoIP over VPN) Based on the VoIP Example 1(Basic Configuration and Registration), we will introduce how to dial the VoIP call through an encrypted VPN tunnel. In this example 3300V

More information

SIP and ENUM. Overview. 2005-03-01 ENUM-Tag @ DENIC. Introduction to SIP. Addresses and Address Resolution in SIP ENUM & SIP

SIP and ENUM. Overview. 2005-03-01 ENUM-Tag @ DENIC. Introduction to SIP. Addresses and Address Resolution in SIP ENUM & SIP and ENUM 2005-03-01 ENUM-Tag @ DENIC Jörg Ott 2005 Jörg Ott 1 Overview Introduction to Addresses and Address Resolution in ENUM & Peer-to-Peer for Telephony Conclusion 2005 Jörg Ott

More information

SIP Trunking Configuration with

SIP Trunking Configuration with SIP Trunking Configuration with Microsoft Office Communication Server 2007 R2 A Dell Technical White Paper End-to-End Solutions Team Dell Product Group - Enterprise THIS WHITE PAPER IS FOR INFORMATIONAL

More information

MODELLING OF INTELLIGENCE IN INTERNET TELEPHONE SYSTEM

MODELLING OF INTELLIGENCE IN INTERNET TELEPHONE SYSTEM MODELLING OF INTELLIGENCE IN INTERNET TELEPHONE SYSTEM Evelina Nicolova Pencheva, Vessela Liubomirova Georgieva Department of telecommunications, Technical University of Sofia, 7 Kliment Ohridski St.,

More information

Deploying Secure Enterprise Wide IP Videoconferencing Across Virtual Private Networks

Deploying Secure Enterprise Wide IP Videoconferencing Across Virtual Private Networks Deploying Secure Enterprise Wide IP Videoconferencing Across Virtual Private Networks Document Overview This document provides an overview of how to effectively and securely provide IP-based videoconferencing

More information

ISG50 Application Note Version 1.0 June, 2011

ISG50 Application Note Version 1.0 June, 2011 ISG50 Application Note Version 1.0 June, 2011 Scenario 1 - ISG50 is placed behind an existing ZyWALL 1.1 Application Scenario For companies with existing network infrastructures and demanding VoIP requirements,

More information

Internet Technology. 14. VoIP and NAT Traversal Paul Krzyzanowski. Rutgers University. Spring 2013

Internet Technology. 14. VoIP and NAT Traversal Paul Krzyzanowski. Rutgers University. Spring 2013 Internet Technology 14. VoIP and NAT Traversal Paul Krzyzanowski Rutgers University Spring 2013 1 Session Initiation Protocol (SIP) Dominant protocol for Voice over IP (VoIP) RFC 3261 Allows a call to

More information