1 TAC2000/ LABORATORY 117 Outline of the Hands-on Tutorial  SIP User-Agent Register Register Make calls Make calls  Fault-Finding Tools Observe the Packets of SIP Messages Observe the Packets of SIP Messages  SIP Registrar/Proxy Server Configuring SER (SIP Express Router) Configuring SER (SIP Express Router)  How do you know other SIP islands DNS SRV/ENUM/ISN DNS SRV/ENUM/ISN  How to authenticate users LDAP, RADIUS LDAP, RADIUS 

2 TAC2000/ LABORATORY 117 SIP UAs and SIP Message Analysis Quincy Wu National Chi Nan University

3 TAC2000/ LABORATORY 117 Exercise 1: SIP UA operations  Download & Install SIP UA  Download & Install Ethereal  Packet Analysis Using Ethereal SIP signaling flow SIP signaling flow RTP traffic RTP traffic SIP headers SIP headers SDP Contents SDP Contents Call Hold/Retrieve Call Hold/Retrieve

4 TAC2000/ LABORATORY 117 Windows-based SIP UA  Microsoft Windows Messenger  NBEN UA  X-Lite

5 TAC2000/ LABORATORY 117 SIP UA – Windows Messenger  By default, Windows XP installs Windows Messenger Version 4.7  There are two messengers from Microsoft MSN Messenger 6.2, 7.0 MSN Messenger 6.2, 7.0 Windows Messenger 4.7, 5.1 Windows Messenger 4.7, 5.1  Inside Windows Messenger - How it Communicates nol/winxppro/evaluate/insid01.mspx nol/winxppro/evaluate/insid01.mspx

6 TAC2000/ LABORATORY 117 Step 1: Configure

7 TAC2000/ LABORATORY 117 Step 2: REGISTER

8 TAC2000/ LABORATORY 117 Step 3: Make A Call

9 TAC2000/ LABORATORY 117 Step 4: Ringing

10 TAC2000/ LABORATORY 117 Step 5: Conversation

11 TAC2000/ LABORATORY 117 Step 6: Answer A Call

12 TAC2000/ LABORATORY 117 SIP UA – NBEN UA  NBEN UA is a SIP User Agent which provides easy interface for IP telephony.  This software was developed as a tool for VoIP tutorials in Taiwan.  You can type the digits and make phone calls directly, without typing the complete SIP URI ( )  It supports features like Hold/Retrieve, Redial, Speed Dial, Transfer.

13 TAC2000/ LABORATORY 117 Features  NBEN UA runs on Windows 2000/XP/2003.  Both signaling and media data are transported on UDP. SIP: port 5060 SIP: port 5060 RTP: port 9000 RTP: port 9000  Supported audio codec: G.711 (64Kbps) G.711 (64Kbps) G.729 (8Kbps) G.729 (8Kbps) G (6.3Kbps) G (6.3Kbps)

14 TAC2000/ LABORATORY 117 Download NBEN SIP UA  Download link & Installation guide can be found at  Phone numbers are assigned in a separate configuration file.  Try to call each other and see the signaling of SIP.  Each SIP UA is required to possess a public IP address. A patch is available to traverse NAT by utilizing STUN. A patch is available to traverse NAT by utilizing STUN.

15 TAC2000/ LABORATORY 117 SIP UA - X-Lite  X-Lite - The Best Free Softphone  A FREE premium SIP softphone with many PBX-like features.  Open standards-based design (SIP) allows for maximum network interoperation and integration.  Download from

16 TAC2000/ LABORATORY 117 Features  Touch-tones [DTMF]  3 Lines, Multiple Proxies  Line Hold  Inbound Call 'Ignore'  Inbound Call 'Go to Voic '  Dial/ Redial/Hangup  Caller ID [SIP ID]  Call Timer  Mute  Microphone & Speakers Levels  Microphone & Speakers Meters  Recent Calls Dialed  Recent Calls Received  Speed Dial  G.711u+a/iLBC/GSM codecs  NAT/Firewall support  Specify NAT IP to be written in SIP messages  Supports Windows 98SE/NT4/ME/2000/XP

17 TAC2000/ LABORATORY 117 Step 1: Configuration

18 TAC2000/ LABORATORY 117 Step 2: Make/Receive Calls  Automatically send a REGISTER request to registrar when the program starts up.  Dial digits, and domain realm will be appended automatically.

19 TAC2000/ LABORATORY 117 Packets Capturing & Analyzing

20 TAC2000/ LABORATORY 117 Fault-Finding Tools  Ethereal GUI on Windows XP/Linux/FreeBSD GUI on Windows XP/Linux/FreeBSD  Tcpdump/tEthereal/ngrep Plaintext on Linux/FreeBSD Plaintext on Linux/FreeBSD  SIPSAK “Traceroute” of SIP “Traceroute” of SIP

21 TAC2000/ LABORATORY 117 Ethereal – What Is It?  Every network manager at some time or other needs a tool that can capture packets off the network and analyze them.  In the past, such tools were either very expensive, proprietary, or both.  With the advent of Ethereal, all that has changed.  "A rose by any other name would smell as sweet." - William Shakespeare

22 TAC2000/ LABORATORY 117 Features of Ethereal  Available for UNIX and Windows.  Capture and display packets from any interface on a UNIX system.  Display packets captured under a number of other capture programs: tcpdump tcpdump Network Associates Sniffer and Sniffer Pro Network Associates Sniffer and Sniffer Pro NetXray NetXray Microsoft Network Monitor Microsoft Network Monitor  Filter packets on many criteria.  Colorize packet display based on filters  Allow people to add new protocols to Ethereal.

23 TAC2000/ LABORATORY 117 Where to Get Ethereal  Official site:  Local mirror:

24 TAC2000/ LABORATORY 117 Install Ethereal under Windows  Install WinPcap 3.1. WinPcap is an architecture for packet capture and network analysis for the Win32 platforms. WinPcap is an architecture for packet capture and network analysis for the Win32 platforms. It includes It includes  a kernel-level packet filter,  a low-level dynamic link library (packet.dll), and  a high-level and system-independent library (wpcap.dll, based on libpcap version 0.6.2)  Install Ethereal

25 TAC2000/ LABORATORY 117 Starting Ethereal

26 TAC2000/ LABORATORY 117 Capturing packets with Ethereal

27 TAC2000/ LABORATORY 117 The Capture Preferences dialog box

28 TAC2000/ LABORATORY 117 Stop after you have collected enough packets

29 TAC2000/ LABORATORY 117 File – Save As

30 TAC2000/ LABORATORY 117 Show Packet in New Window

31 TAC2000/ LABORATORY 117 Capture Filters

32 TAC2000/ LABORATORY 117 Filtering While Capturing

33 TAC2000/ LABORATORY 117 Syntax of the tcpdump capture filter language  [not] primitive [and|or [not] primitive...] tcp port 23 and host tcp port 23 and host tcp port 23 and not host tcp port 23 and not host  tcpdump filter language is explained in the man page.

34 TAC2000/ LABORATORY 117 Capturing SIP signaling (filter: udp port 5060)

35 TAC2000/ LABORATORY 117 SIP Call Establishment  It is simple, which contains a number of interim responses.

36 TAC2000/ LABORATORY 117 Basic Call Flow

37 TAC2000/ LABORATORY 117

38 TAC2000/ LABORATORY 117

39 TAC2000/ LABORATORY 117

40 TAC2000/ LABORATORY 117 REGISTER

41 TAC2000/ LABORATORY OK

42 TAC2000/ LABORATORY 117 INVITE

43 TAC2000/ LABORATORY 117 SDP in INVITE

44 TAC2000/ LABORATORY OK

45 TAC2000/ LABORATORY 117 SDP in 200 OK

46 TAC2000/ LABORATORY 117 ACK

47 TAC2000/ LABORATORY 117 Capturing the packets of Media Data

48 TAC2000/ LABORATORY 117 RTP Traffic (udp port 9000)  What’s wrong?

49 TAC2000/ LABORATORY 117 Tools – Decode As RTP

50 TAC2000/ LABORATORY 117 Display Filter

51 TAC2000/ LABORATORY 117 Display – Colorize Display

52 TAC2000/ LABORATORY 117 Emphasize the packets you are interested in

53 TAC2000/ LABORATORY 117 Hold/Unhold of NBEN UA

54 TAC2000/ LABORATORY 117 Hold

55 TAC2000/ LABORATORY 117 Retrieve

56 TAC2000/ LABORATORY 117 Summary  We demonstrate the functions of Windows Messenger and NBEN UA, which are two SIP User Agents with friendly user interface.  We demonstrate the functions of Ethereal, which is a powerful tool for packets capturing & analyzing: Capture Filters Capture Filters Colorized Packets Colorized Packets  Practice using this tool to capture SIP signaling in the following call flows REGISTER – 200 OK REGISTER – 200 OK INVITE – 200 OK - ACK INVITE – 200 OK - ACK BYE – 200 OK BYE – 200 OK Hold/Retrieve Hold/Retrieve