https://blog.wireshark.org/tags/voip/ Recent content in voip on The Official Wireshark Blog Hugo -- gohugo.io en-us Mon, 28 Sep 2009 21:20:29 +0000 https://blog.wireshark.org/2009/09/polycom-ip-phone-boot-analysis/ Mon, 28 Sep 2009 21:20:29 +0000 https://blog.wireshark.org/2009/09/polycom-ip-phone-boot-analysis/ <p>We use Polycom SoundPoint IP phones here at the CACE Technologies World Domination Secret Lair. While troubleshooting a different problem recently I noticed that the phones do something funny. During the boot process they obtain an IP address via DHCP, similar to most PCs. A DHCP option tells the phones to fetch their configuration and firmware from an FTP server. The funny part is that some of the FTP transfers were failing even though the phones booted up just fine:</p> <div id="attachment_143" style="width: 468px" class="wp-caption alignnone"> <img loading="lazy" decoding="async" aria-describedby="caption-attachment-143" class="size-full wp-image-143" title="SIP firmware failure" src="https://blog.wireshark.org/wp-content/uploads/2009/09/SIP-firmware-failure.png" alt="SIP firmware download failure" width="458" height="255" /> <p id="caption-attachment-143" class="wp-caption-text"> SIP firmware download failure </p> </div> <p>At packet 175 the phone starts to download <em>sip.ld</em>, the SIP firmware image. The transfer starts at packet 177, but the phone cuts the transfer short at packet 181. The phone then behaves as if nothing is wrong. What’s going on here?</p> <p>At this point the phone <strong>might</strong> have an up-to-date copy of the SIP firmware. It would be nice if it could avoid downloading this file every time it booted up. The file is 15 MB, so in some environments this would be <strong>really</strong> nice. (Imagine a thousand phones trying to download this file at the same time after a power outage. Over a fractional T1. That’s flapping.) Unfortunately methods for comparing files via FTP or HTTP to ones you already have are either <a href="http://www.ietf.org/rfc/rfc1864.txt">rarely used</a> or <a href="http://cwiki.apache.org/FTPSERVER/draft-twine-ftpmd5-00.html">not supported at all</a>.</p> <p>Running the <em>strings</em> command on the firmware turns up the following tidbit at the beginning of the file:</p> <pre style="padding-left: 30px;">Checksum=0x00008c5e</pre> <p>It looks like the phones look for the checksum in the firmware header and drop the connection once they’ve determined they already have an up-to-date copy.</p> <p>This is a very roundabout way of showing that sometimes error conditions on your network are not only normal but beneficial.</p> <h2 id="comments">Comments <a href="#comments" class="anchor">🔗</a></h2><h3 id="comment-by-bperkic-on-2009-09-30-010736-0000">Comment by bperkic on 2009-09-30 01:07:36 +0000 <a href="#comment-by-bperkic-on-2009-09-30-010736-0000" class="anchor">🔗</a></h3><p>Good point! Thx</p> <h3 id="comment-by-rogio-on-2009-10-23-091635-0000">Comment by rogio on 2009-10-23 09:16:35 +0000 <a href="#comment-by-rogio-on-2009-10-23-091635-0000" class="anchor">🔗</a></h3><p>Great Read.</p> <h3 id="comment-by-oldcommguy-on-2009-11-05-110159-0000">Comment by Oldcommguy on 2009-11-05 11:01:59 +0000 <a href="#comment-by-oldcommguy-on-2009-11-05-110159-0000" class="anchor">🔗</a></h3><p>It is no longer a secret…now we know where you are at!!!!</p> <p>Great article – Flapping indeed and an real OMG!</p>