DComTalk.com

After learning that the Linksys RT32P2 I purchased was locked to
Vonage, I returned it. While at Staples I noticed the Linksys
PAP2. I asked a sales person about whether or not it was
similarly locked. We noted that it did not list Vonage service
under the minimum requirements and he encouraged me to just get
it and return it if it didn't work.

Well...I've been trying it. It does indeed appear to be an
SPA-2000 under the hood. When it boots, it makes a TFTP request
to ls.tftp.vonage.net for "/spa000F66A84007.xml". The Web
interface is Linksys-branded but similar to the Sipura devices.

One of the options is "Admin Login". When I tried this, I was
unable to authenticate successfully. I called Linksys support
in India. After a couple of people told me that there was no
Web interface, I made a tunnel to the PAP2 and gave one of the
technicians the URL. He tried it. Long silence.

Finally he said that he had examined the URL and determined it
to be a PAP2 simulator. Arrghh! It took a few more minutes
to convince him that it's the non-existant Web interface on
*my* PAP2 that he was seeing. (BTW, another technician told
me to hit a reset button on the unit. There is none. She was
sure it was "near the lights.")

I finally got to talk to Senior Technician Gordon (in the
US?). He quickly explained that it's locked to Vonage. It
only took an hour on the phone to get the answer but it was at
least a bit entertaining.

BTW, it does appear that the unit can directly dial IP
addresses without registering with Vonage. So you *could* use
it on its own (especially on a phone with speed dial) or with
Asterisk. It's not worth it to me though.

Back goes another piece of Linksys hardware... I'll spend the
extra $20 for hardware I control.

--kyler

Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
the spa000F66A84007.xml file yourself? Just an idea.

"Kyler Laird" <Kyler@news.Lairds.org> wrote in message
news:06m312-uvh.ln1@lairds.us...

After learning that the Linksys RT32P2 I purchased was locked to
Vonage, I returned it. While at Staples I noticed the Linksys
PAP2. I asked a sales person about whether or not it was
similarly locked. We noted that it did not list Vonage service
under the minimum requirements and he encouraged me to just get
it and return it if it didn't work.

Well...I've been trying it. It does indeed appear to be an
SPA-2000 under the hood. When it boots, it makes a TFTP request
to ls.tftp.vonage.net for "/spa000F66A84007.xml". The Web
interface is Linksys-branded but similar to the Sipura devices.

One of the options is "Admin Login". When I tried this, I was
unable to authenticate successfully. I called Linksys support
in India. After a couple of people told me that there was no
Web interface, I made a tunnel to the PAP2 and gave one of the
technicians the URL. He tried it. Long silence.

Finally he said that he had examined the URL and determined it
to be a PAP2 simulator. Arrghh! It took a few more minutes
to convince him that it's the non-existant Web interface on
*my* PAP2 that he was seeing. (BTW, another technician told
me to hit a reset button on the unit. There is none. She was
sure it was "near the lights.")

I finally got to talk to Senior Technician Gordon (in the
US?). He quickly explained that it's locked to Vonage. It
only took an hour on the phone to get the answer but it was at
least a bit entertaining.

BTW, it does appear that the unit can directly dial IP
addresses without registering with Vonage. So you *could* use
it on its own (especially on a phone with speed dial) or with
Asterisk. It's not worth it to me though.

Back goes another piece of Linksys hardware... I'll spend the
extra $20 for hardware I control.

--kyler

"Brendon" <brendon@nospam-itology.net> writes:

Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
the spa000F66A84007.xml file yourself? Just an idea.

That is a very interesting idea. Anyone know if the format of that
file defined anywhere?

I haven't been able to find much information about constructing either
Sipura or Bugtone config files. It would be nice to be able to
program them via a file that I could keep under CVS instead of some
web browser interface that doesn't allow me to save a copy of the
phone's state.

-wolfgang
--
Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/

***"When it boots, it makes a TFTP request to ls.tftp.vonage.net for
"/spa000F66A84007.xml"***

I'll hazard a guess that 00:0F:66:A8:40:07 is the MAC address of the
Linksys, this is how a Cisco 7960 requests its config file from a TFTP
server using Asterisk - the file name requested is specific to the MAC
address.

"Wolfgang S. Rupprecht"
<wolfgang+gnus20040908T180513@dailyplanet.dontspam.wsrcc.com> wrote in
message news:x7isaoqm9c.fsf@bonnet.wsrcc.com...

"Brendon" <brendon@nospam-itology.net> writes:
Could you spoof ls.tftp.vonage.net to point to your tftp server and
provide
the spa000F66A84007.xml file yourself? Just an idea.

That is a very interesting idea. Anyone know if the format of that
file defined anywhere?

I haven't been able to find much information about constructing either
Sipura or Bugtone config files. It would be nice to be able to
program them via a file that I could keep under CVS instead of some
web browser interface that doesn't allow me to save a copy of the
phone's state.

-wolfgang
--
Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/

"Brendon" <brendon@nospam-itology.net> writes:

Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
the spa000F66A84007.xml file yourself? Just an idea.

That was my idea too. Take a look at the file though. I have a
feeling that it's a signed config file. It probably references
some firmware that's downloaded if it's different than the
current version. I'd expect it to be signed too.

Those are all guesses though. I'd love to discover that I'm
wrong but I went ahead and had a couple *real* SPA-2000s air
mailed to me this evening. I don't have time to mess around
with "buying" hardware I don't control.

--kyler

I just got this from Jeremy McNamara who is apparently still upset
at me for trying to provide help with his ticket handling system.
The only thing for which he has shown any appreciation has been my
posting of his information, so here goes...

The PAP2 and the RT31P2 both are ABSOLUTELY NOT ~LOCKED~ to Vonage.

I have personally reconfigured both units to talk to any SIP proxy,
without opening the unit or otherwise violating the warranty

If you were a nicer person I might give you a few really good tips. All
I will say is the other people that responded to your post are on the
right track.


Jeremy McNamara

--kyler

Can you post the file or email it to me?

"Kyler Laird" <Kyler@news.Lairds.org> wrote in message
news:cto412-arl.ln1@lairds.us...

"Brendon" <brendon@nospam-itology.net> writes:

Could you spoof ls.tftp.vonage.net to point to your tftp server and
provide
the spa000F66A84007.xml file yourself? Just an idea.

That was my idea too. Take a look at the file though. I have a
feeling that it's a signed config file. It probably references
some firmware that's downloaded if it's different than the
current version. I'd expect it to be signed too.

Those are all guesses though. I'd love to discover that I'm
wrong but I went ahead and had a couple *real* SPA-2000s air
mailed to me this evening. I don't have time to mess around
with "buying" hardware I don't control.

--kyler

"Brendon" <brendon@nospam-itology.net> writes:

Can you post the file or email it to me?

Anyone can get the file through TFTP.

--kyler

I'm apparently a Usenet posting service now. It's not clear to
me what the value of this is but perhaps someone else can use it.

--kyler

=================================================================

From: Jeremy McNamara <jj@nufone.net>
Subject: Detail

*CLI>

Sip read:
INVITE sip:18102341212@X.X.X.X SIP/2.0
Via: SIP/2.0/UDP 192.168.1.125:5060;branch=z9hG4bK-f85be36a
From: <sip:pap2@X.X.X.X>;tag=96564193ae44263e
To: <sip:12319723156@X.X.X.X>
Call-ID: f2ce5b85-7638edb2@192.168.1.125
CSeq: 101 INVITE
Max-Forwards: 70
Contact: <sip:pap2@192.168.1.125:5060>
Expires: 240
User-Agent: Linksys/PAP2-2.0.9(LSd)
Content-Length: 422
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER
Supported: x-sipura
Content-Type: application/sdp

v=0
o=- 26868 26868 IN IP4 192.168.1.125
s=-
c=IN IP4 192.168.1.125
t=0 0
m=audio 16442 RTP/AVP 0 2 4 8 18 96 97 98 100 101
a=rtpmap:0 PCMU/8000
<snip>

*CLI> sip show peer pap2
* Name : pap2
Secret : <Set>
MD5Secret : <Not set>
Context : NANPA
Language :
FromUser :
FromDomain :
Callgroup : (0)
Pickupgroup : (0)
Mailbox :
LastMsgsSent : -1
Dynamic : Yes
Expire : 991
Expiry : 900
Insecure : No
Nat : Always
ACL : No
CanReinvite : Yes
PromiscRedir : No
DTMFmode : rfc2833
LastMsg : 0
ToHost :
Addr->IP : X.X.X.X Port 5060
Defaddr->IP : 0.0.0.0 Port 5060
Username : pap2
Codecs : G.729A
Status : UNKNOWN
Useragent : Linksys/PAP2-2.0.9(LSd)
Full Contact : sip:pap2@192.168.1.125:5060




Jeremy McNamara


P.S. Yes, it works thru my home NAT, as you can see

Care to share? Anyone by chance have Vonage and willing to give me
their MAC address or a copy of their tftp downloaded "xml" file? I
bought a couple of these units after the sales people at Fry's told me
"they are not locked to Vonage, but are bundeled with it. You can use
them with any VoIP provider." And I like a lot of other people would
like to be able to use them with any VoIP provider. I opened up one of
the units and was going to desolder the two flash roms and read them
in an attempt to be able to "unlock" them. But that may not be
necessary?

Thanks,

Dustin


Kyler Laird <Kyler@news.Lairds.org> wrote in message news:<8fr412-00m.ln1@lairds.us>...

I just got this from Jeremy McNamara who is apparently still upset
at me for trying to provide help with his ticket handling system.
The only thing for which he has shown any appreciation has been my
posting of his information, so here goes...

The PAP2 and the RT31P2 both are ABSOLUTELY NOT ~LOCKED~ to Vonage.

I have personally reconfigured both units to talk to any SIP proxy,
without opening the unit or otherwise violating the warranty

If you were a nicer person I might give you a few really good tips. All
I will say is the other people that responded to your post are on the
right track.


Jeremy McNamara

--kyler

t0k3n@hotmail.com (Dustin) writes:

Care to share? Anyone by chance have Vonage and willing to give me
their MAC address or a copy of their tftp downloaded "xml" file?

I posted the server and path for mine awhile ago.

Good luck!

--kyler

I checked this file out - its encrypted somehow, right? Just want to make
sure we're on the same page.

"Kyler Laird" <Kyler@news.Lairds.org> wrote in message
news:orub22-3v2.ln1@lairds.us...

t0k3n@hotmail.com (Dustin) writes:

Care to share? Anyone by chance have Vonage and willing to give me
their MAC address or a copy of their tftp downloaded "xml" file?

I posted the server and path for mine awhile ago.

Good luck!

--kyler

In message <75K4d.145140$4h7.23635037@twister.nyc.rr.com> "Brendon"
<brendon@nospam-itology.net> wrote:

I checked this file out - its encrypted somehow, right? Just want to make
sure we're on the same page.

Yes...


--
Do not taunt zombie badgers

Kyler Laird <Kyler@news.Lairds.org> wrote in message news:<orub22-3v2.ln1@lairds.us>...

t0k3n@hotmail.com (Dustin) writes:

Care to share? Anyone by chance have Vonage and willing to give me
their MAC address or a copy of their tftp downloaded "xml" file?

I posted the server and path for mine awhile ago.

Good luck!

--kyler

I made the assumption you did not have active service with Vonage
currently under that mac address. I used a tftp client and pulled the
file. Based on the first few characters of the file Salted__ I would
have to agree with everyone that the file appears to be Salt
encrypted...

DevilsPGD <theone@crazyhat.net> wrote in message news:<_qM4d.1971284$6p.338208@news.easynews.com>...

In message <75K4d.145140$4h7.23635037@twister.nyc.rr.com> "Brendon"
brendon@nospam-itology.net> wrote:

I checked this file out - its encrypted somehow, right? Just want to make
sure we're on the same page.

Yes...

I was under the impression that all units downloaded a "firmware"
file, not just the active ones. This is not that case. Virgin MAC's do
not have a file. I downloaded a few different MAC's by incrementing
the *known* good MAC and ran kDiff against the files. They are
different. So maybe the salt somehow involves that MAC?