Subject: RE: [hackers-il] VoIP the SIP way and NAT traversal

From: "Arik Baratz" <[email-masked]>
Date: Mon, 15 Sep 2003 17:26:32 +0300

-----Original Message----- 
From: Gilad Ben-Yossef [mailto:[email-masked]] 

> > The actual voice channel traverses a different path, and is usually RTCP
> Actually, the media runs in RTP (Real Time Protocol) and RTCP (Real Time
> Control Protocol) is just a control channel that delivers statistics and the
> like.

You are right - my bad. I meant to say that. Yes. That's it.
.
> > Various NAT-bypassing tricks have been taken into account (such as [2]).
> ...Most of which are horrible hacks with gaping security holes...
 
Can you please elaborate? How can a NAT-bypassing "trick" (which is indeed a horrible hack) be a gaping security hole?
 
I'll try to answer myself: By sending in the clear information about the return path to a process on the user's computer, which, if not properly written, can contain arbitary security holes and compromise the entirr network
 
And I'll answer you by saying that HTTP has the exact same properties - if you can sniff a session you can hijack a session, and once you did you can inject anything into it, so either use strong authentication (SIP/TLS is discussed in the RFC, and that's assuming the TLS implementation is bugless) or write your software well.

> > My personal experience is very good. I'm using FWD [3]. I have managed to
> > make calls to my girlfriend at home from various locations in the world (I
> > am writing this from India). I'm using the X-Lite softphone in [6] on my
> > Windows laptop. NAT traversal works great. Sound quality is far superior to
> > the international calls I have made using a calling card, except that the
> > round trip of anything I say is 4 seconds. There is no echo canceling, so I
> Here's a news flash - most of your calling card calls are going over VoIP
> also, alebit not always via the public Internet. There's a good chance that
> the horrid legacy (read: used by everyone despite being a horrid mess) H.323
> ITU protocol is used rather then SIP, but that doesn't change much. The
> quality is bad because the ITSP has a poor connection and is overusing his
> network links to the max.

Well duh, they are doing it for years now. That's why you have a commercial boom for "1010" and other '16cent/minute international calls' thingies in the US. A friend of mine informed me that in China you can dial a prefix before any LD call and it will route it over VoIP, probably with horrid quality, and you pay 50% of the price.
 
BTW IIRC an AT&T rep said AT&T will offer their own VoIP service, where the main features would be that you can take your phone anywhere and have the same number...

> The 4 seconds round trip time is most likely caused by your internet
> connection going via a satelite link
 
I rather think it's the jitter/latency compromise that the clients agree on. I don't think it's a sattelite link. My pings come back mucho rapido.
 
4 sec rtt means that you only hear a response to your things 4 seconds after you're done talking. Beyond the social implications that this has, while in such a conversation I try to predict when the other person will stop speaking and try to speak just then. It works more often than not. Once you go into a conversation you tend to ignore minor hassles like a 4 minute delays, and you tend to speak more thoroughly to compensate and reduce the number of round-trips :-)
 
Okay I'm nuts. Kill me and be done with it.

> > An interesting aspect IMHO is the NAT traversal capabilities, but this is
> > getting too long.
>The only really interesting thing in this area in a long time is skype :-)

I'm sorry if I'm a tad skeptyk, but I want to: A. see their network go, and B. see their interoperability factor. I believe you share my beliefs (phew) about the necessity of openness. If KaZaA/FastTrack is any indication, it will be nill AND install spyware on your computer, and change their encryption scheme whenever an open source project will get close to interoperate on their network. Oh, how good it feels to spread FUD. No wonder Microsoft are addicted to it.
 
OTOH both Zannstrum and Pulver said publicly that they will willingly allow calls between their networks (Pulver has connectivity to 4-5 other SIP providers) but I'm still betting that the actual protocol will remain proprietary, secret and encrypted.
 
> Codefidence. A name you can trust (tm)
> http://www.codefidence.com
 
Mind giving your hacker friends a sneak-peek?
 
-- Arik
**********************************************************************
This email and attachments have been scanned for
potential proprietary or sensitive information leakage. 

PortAuthority(TM)  Server 
Keeping Information Inside
Vidius, Inc. 
www.vidius.com
**********************************************************************

---

From: Oleg Goldshmidt <[email-masked]>
Date: 19 Sep 2003 16:05:07 +0300

Disclaimer: I used to work on VoIP QoS. I am not in the field at
present. If there are relevant shares in my portfolio, I don't know
about them.

"Arik Baratz" <[email-masked]> writes:

> > Here's a news flash - most of your calling card calls are going
> > over VoIP also, alebit not always via the public Internet. network
> > links to the max.
> 
> Well duh, they are doing it for years now. That's why you have a
> commercial boom for "1010" and other '16cent/minute international
> calls' thingies in the US. 

Actually, you probably never know when your long distance phone call
travels all or part of the way in RTP/IP packets. It's not just calling
cards and discount services. The difference between them and your
regular calls may be just the QoS guarantees given by networks.

> I rather think it's the jitter/latency compromise that the clients
> agree on. 

What compromise are you talking about? If anything, network latency
and jitter (and packet loss) are likely to be correlated. In fact,
there is probably significant jitter and out-of-order arrivals that
get translated into extra latency to keep speech intelligible. I doubt
there are any working systems that wait for 2 seconds to reorder
because that's way above what is considered bearable (anything above
250 ms one way - including packetization and re-assembly - is
considered unusable for practical purposes).

The 4 sec RTT (as you define it) is not necessarily all satellite, and
it is a bit difficult to say how bad it is (it's really bad for sure)
since it does not translate into the normal one-way packet latency
directly.

> I don't think it's a sattelite link. My pings come back mucho
> rapido.

Your pings don't sit in buffers waiting for their friends to arrive
and form something coherent. They may also be routed differently,
strictly speaking. RTP is supposed to be routed to minimize the
latency, but what actually happens in a best effort network between
India and Israel is anyone's guess.

> Okay I'm nuts. Kill me and be done with it.

You are. 4 sec RTT is not a duplex phone conversation as we know
it. But if your girlfriend likes the quality of conversation you
manage to maintain in these adverse conditions, doesn't kill you, and
is not done with it, who are we to judge?... ;-)

-- 
Oleg Goldshmidt | [email-masked]

---

From: Arik Baratz <[email-masked]>
Date: Sun, 21 Sep 2003 00:11:47 +0300

>get translated into extra latency to keep speech intelligible. I doubt
Thta's the compromise I'm talking about.

>considered unusable for practical purposes).
No, 2 second is the time the packets need to travel one way PLUS the 
reordering latency. That being said, I had long distance calls with 
more-or-less the same roundtrip delay, out of "regular" voice lines. 
They are more than usable. After some time you just get used to it 
("some time" defined as 10 minutes give or take).

>is not done with it, who are we to judge?... ;-)
Well, actually most phone calls I had from India from a cellphone in 
India to a cellphone in Israel have a latency close to that, and like I 
said they're usable.

-- Arik