Subject: VoIP the SIP way and NAT traversal

From: "Arik Baratz" <[email-masked]>
Date: Mon, 15 Sep 2003 14:26:33 +0300

Hello all

I'm sorry if this mail format is bad for your eyes. I'm using OWA (outlook web access). Yes, scorn and laugh, but be in my place first.

I have recently been reviewing a "new" technology, which is totally unrelated to my company, but is waaaay cool and useful.

I am talking about VoIP by means of the SIP protocol.

SIP (=Session Initiation Protocol) is RFC 3261 [1]. It is a nice, UTF-8 over UDP/TCP - based protocol which handles two important aspects of making a VoIP call - registration (SIP describes how you register yourself at a locator service) and session initiation (SIP transfers information between the parties communicating with each other regarding the voice channel). It is possible to go on for hours about SIP. Look at [7].

The actual voice channel traverses a different path, and is usually RTCP. Various NAT-bypassing tricks have been taken into account (such as [2]). SIP is not only for VoIP - it can be used to transfer any type of media between two peers, using the central registrar as the means of locating the peers by their URI rather than their IP address.

Several organizations (such as [3][4][5]) has taken it upon themselves to provide free directory services for free, for various reasons. You can sign up with one of these and start using SIP compatible phones. There are some companies that make them ([8][9]). You can also get a software phone (dubbed softphone) and use it today, for free.

For the more pragmatic Win/WinCE/Mac users among us: Go to [6], download, install, register, call 613 for an echo test. You're done. Behind a NAT? Do the same. More often than not it will work. On Linux there's kphone and I think it's not the only one, but you will have to sign up and configure manually.

My personal experience is very good. I'm using FWD [3]. I have managed to make calls to my girlfriend at home from various locations in the world (I am writing this from India). I'm using the X-Lite softphone in [6] on my Windows laptop. NAT traversal works great. Sound quality is far superior to the international calls I have made using a calling card, except that the round trip of anything I say is 4 seconds. There is no echo canceling, so I am using a headset, but that is not too big a limitation IMHO.

I had my boss install it, and he was up and running in 5 minutes. My entire family is signed up with FWD and I am quite content. Recently Jeff Pulver, the VoIP advocate that has set up FWD had pulled some stats from the database - and Israel is located in the 8th place with 2% of the subscriber base (which makes it around 1000 users). Pakistan is in 7th place, again 2%, so with your help we can easily beat them Pakistanis. India is in the 6th place with 3% of the subscriber base. Sign up as many people as you can.

There are serious political implications to widely-used VoIP technology - the traditional telephone infrastructure is having difficulty accepting the separation of medium and service. Once a critical mass of users will use VoIP, the telcos will realize that their revenue paradigms are becoming obsolete. There has been some noise in the news about this, search news.google.com for "Vonage". 

An interesting aspect IMHO is the NAT traversal capabilities, but this is getting too long.

[1] http://www.faqs.org/rfcs/rfc3261.html

[2] http://www.faqs.org/rfcs/rfc3581.html

[3] http://www.freeworlddialup.com

[4] http://www.iptel.org/user/

[5] http://my.sipphone.com/user/reg/index.php

[6] http://brands.xten.net/x-litefwd/download/X-LiteFWD_Install.exe

[7] http://www.cs.columbia.edu/sip

[8] http://www.cisco.com/en/US/products/hw/phones/ps379/index.html

[9] http://www.grandstream.com/y-product.htm

-- Arik

**********************************************************************
This email and attachments have been scanned for
potential proprietary or sensitive information leakage. 

PortAuthority(TM)  Server 
Keeping Information Inside
Vidius, Inc. 
www.vidius.com
**********************************************************************

---

From: Gilad Ben-Yossef <[email-masked]>
Date: Mon, 15 Sep 2003 15:59:46 +0300

On Monday 15 September 2003 14:26, Arik Baratz wrote:
> Hello all
>
> I'm sorry if this mail format is bad for your eyes. I'm using OWA (outlook
> web access). Yes, scorn and laugh, but be in my place first.
>
> I have recently been reviewing a "new" technology, which is totally
> unrelated to my company, but is waaaay cool and useful.
>

Warning: I have worked in the past for and currently advising a company called 
Kagoor, whose main business is VoIP border control, which means everything 
that goes on with VoIP and network borders - firewalling, SLA, NAT ad 
Nasdakum... I don't own any stocks or options in them though.

> SIP (=Session Initiation Protocol) is RFC 3261 [1]. It is a nice, UTF-8
> over UDP/TCP - based protocol which handles two important aspects of making
> a VoIP call - registration (SIP describes how you register yourself at a
> locator service) and session initiation (SIP transfers information between
> the parties communicating with each other regarding the voice channel). It
> is possible to go on for hours about SIP. Look at [7].
>
> The actual voice channel traverses a different path, and is usually RTCP

Actually, the media runs in RTP (Real Time Protocol) and RTCP (Real Time 
Control Protocol) is just a control channel that delivers statistics and the 
like.
.
> Various NAT-bypassing tricks have been taken into account (such as [2]).

...Most of which are horrible hacks with gaping security holes...

> SIP is not only for VoIP - it can be used to transfer any type of media
> between two peers, using the central registrar as the means of locating the
> peers by their URI rather than their IP address.
>
> Several organizations (such as [3][4][5]) has taken it upon themselves to
> provide free directory services for free, for various reasons. You can sign
> up with one of these and start using SIP compatible phones. There are some
> companies that make them ([8][9]). You can also get a software phone
> (dubbed softphone) and use it today, for free.
>
> For the more pragmatic Win/WinCE/Mac users among us: Go to [6], download,
> install, register, call 613 for an echo test. You're done. Behind a NAT? Do
> the same. More often than not it will work. On Linux there's kphone and I
> think it's not the only one, but you will have to sign up and configure
> manually.

gphone work too and there are others.
>
> My personal experience is very good. I'm using FWD [3]. I have managed to
> make calls to my girlfriend at home from various locations in the world (I
> am writing this from India). I'm using the X-Lite softphone in [6] on my
> Windows laptop. NAT traversal works great. Sound quality is far superior to
> the international calls I have made using a calling card, except that the
> round trip of anything I say is 4 seconds. There is no echo canceling, so I

Here's a news flash - most of your calling card calls are going over VoIP 
also, alebit not always via the public Internet. There's a good chance that 
the horrid legacy (read: used by everyone despite being a horrid mess) H.323 
ITU protocol is used rather then SIP, but that doesn't change much. The 
quality is bad because the ITSP has a poor connection and is overusing his 
network links to the max. 

The 4 seconds round trip time is most likely caused by your internet 
connection going via a satelite link
> am using a headset, but that is not too big a limitation IMHO.
>
> I had my boss install it, and he was up and running in 5 minutes. My entire
> family is signed up with FWD and I am quite content. Recently Jeff Pulver,
> the VoIP advocate that has set up FWD had pulled some stats from the
> database - and Israel is located in the 8th place with 2% of the subscriber
> base (which makes it around 1000 users). Pakistan is in 7th place, again

That's not a big surprise, as Mr. Pulver knows quite well (being an early 
investor in Kagoor among other things for example :-), there's a LOT of 
Israelis involved in this area. 

> 2%, so with your help we can easily beat them Pakistanis. India is in the
> 6th place with 3% of the subscriber base. Sign up as many people as you
> can.
>
> There are serious political implications to widely-used VoIP technology -
> the traditional telephone infrastructure is having difficulty accepting the
> separation of medium and service. Once a critical mass of users will use
> VoIP, the telcos will realize that their revenue paradigms are becoming
> obsolete. There has been some noise in the news about this, search
> news.google.com for "Vonage".
>

The only really interesting thing in this area in a long time is skype :-)

Gilad
-- 
Gilad Ben-Yossef <[email-masked]>
Codefidence. A name you can trust (tm)
http://www.codefidence.com

---

From: "Tzahi Fadida" <[email-masked]>
Date: Mon, 15 Sep 2003 17:31:50 +0200

the problem is, that skype is proprietery as they come and there is no source code, and my attempts to elicit some explanations on whats going on under the hood failed this far.
specifically it would be interesting to know the methods they used in their (alleged) new global directory indexing technology. also, it would be nice to know what are the methods they used for routing packets and choosing better paths.

* - * - *
Tzahi Fadida
MSc Student
Information System Engineering Area
Faculty of Industrial Engineering & Management
Technion - Israel Institute of Technology
Technion City, Haifa, Israel 32000
Email [email-masked]
Technion Email: [email-masked]
* - * - * - * - * - * - * - * - * - *

WARNING TO SPAMMERS:  see at http://members.lycos.co.uk/my2nis/spamwarning.html

> -----Original Message-----
> From: Gilad Ben-Yossef [mailto:[email-masked]]
> Sent: Monday, September 15, 2003 3:00 PM
> To: [email-masked]; Arik Baratz
> Subject: Re: [hackers-il] VoIP the SIP way and NAT traversal
> 
> 
> ..Most of which are horrible hacks with gaping security holes...
> 
> To unsubscribe from this group, send an email to:
> [email-masked]
> 
>  
> 
> Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/ 
> 
> 
> 
>