4 ms·
> Use a SIP Application Layer Gateway. This is a horrible feature offered by some routers. Basically, it deep-packet-inspects your SIP traffic, rewrites the hea
by hashstring 3y ago
> Use a SIP Application Layer Gateway. This is a horrible feature offered by some routers. Basically, it deep-packet-inspects your SIP traffic, rewrites the headers, and creates port forwards on-the-fly to make sure the inbound audio stream makes its way to your device. SIP ALGs are a total hack and notoriously buggy.
Yes, these hacky ALG features also allowed internet users to access internal IPs on arbitrary services (!); named “remote arbitrary firewall pinhole control”. The attack was published in 2020 and named NAT slipstreaming [1].
[1] https://samy.pl/slipstream/ https://samy.pl/slipstream/
- jasonjayr 3y agoThis was on by default on a consumer router that was used at a small office. Their VoIP phones would get phantom calls until I discovered this and disabled it.
- hashstring 3y agoWoah, good find. How did you actually find out that this was happening? Network captures? When was this approximately? I’m wondering how widespread this (still) is.
- jasonjayr 3y agoIt would have been 2-3 years ago. I was getting reports of phones ringing, but no audio, no calls record from the VoIP server CDR (which all phones were configured to proxy through) and when looking @ the system logs from the phones, they were reporting nonsensical IP addresses, which pointed to something at the edge of the network.
- jeroenhd 3y agoI'm pretty sure you've solved a mystery I was confused by years ago, back when I was doing tech support. It wouldn't have mattered much because the router/modem combos in use didn't have a switch for SIP ALG anyway, bit it's good router finally know what could've caused the phantom phone ringing.