Analysis Quality of Service on VoIP Application Based on Modified IAX2 Protocol for Eavesdropping Detection

Authors: Irwan Alnarus Kautsar¹, Prof. Ir. Supeno Djanali, M.Sc, Ph.D²

¹ Informatics Engineering, Information Technology Faculty, Institut Teknologi Sepuluh Nopember (ITS)
² Informatics Engineering, Information Technology Faculty, Institut Teknologi Sepuluh Nopember (ITS)

Published in: Prosiding Seminar Nasional Manajemen Teknologi XV, Program Studi MMT-ITS, Surabaya, 4 February 2012
ISBN: 978-602-97491-4-4
Available on ResearchGate: Download

Abstract

VoIP implementation for Next Generation Network is an alternative way for communication through the internet, as audio streaming or video streaming. Another way to deploy VoIP service uses Asterisk Server with the IAX2 protocol.

This paper analyzes the IAX2 protocol. IAX2 is one general protocol used in VoIP technology for connecting with other Asterisk Servers and has many susceptible security issues. The aim of this work is to present quality of service, possible threats, secure mechanisms, and deployment based on a modified IAX2 protocol for eavesdropping detection, on the OPNET Simulator.

The result shows that the delay of a packet captured in IAXServer1 and IAXServer2 is between 0.00001 and 0.00002 sec. Based on standard QoS tables, the VoIP application with modified miniframe is of good quality.

Keywords: VoIP, Asterisk, IAX2

Introduction

According to Ram Dantu et al., VoIP is the third generation after PSTN and cellular phone. It makes it possible for many people to build their own VoIP/proxy server. Asterisk is one open source PBX/VoIP/Proxy server and uses the IAX2 protocol for control and transmitting streaming data or communication between Asterisk servers.

In this paper, we present a mechanism for eavesdropping detection using the MAC Address from the router that routes the packets. The contribution of this research is to give a reference mechanism for implementing the IAX2 protocol with eavesdropping detection in future works.

Method

IAX2 Protocol

IAX2 (Inter-Asterisk eXchange version 2) is the native protocol in Asterisk. The advantages of using the IAX2 Protocol are bypassing NAT and using only a single port (4569) for transmitting media and control messages.

The IAX2 protocol contains two sessions: signaling and media flow transmission.

Figure 1. IAX2 Signaling/Call setup Protocol

For the media flow transmission session, it flows a 4-byte header called IAX2 Mini frames (labeled M) and flows Full Frames periodically (F(t)) for synchronization.

Figure 2. IAX2 media transmission with Mini frames and Full frames

For frame contained in mini frame shown in Figure3.

Figure 3. IAX2 mini frame structure

Mini frames are used for media transmission (sent sequentially, not periodically). A Full frame (Figure 4) is periodical in F(t)(Figure2) and contains many bits, so modifying a mini frame is suitable, although signaling session is use Full frame.

Figure 4. IAX2 Full frame structure

IAX2 Protocol Threat

Because the IAX2 protocol uses a single port (4569), an attacker can sniff or eavesdrop packets through that port. The eavesdropping attack was clearly demonstrated by Rajagopalan [3], using a tool called Unsniff. Other threats related to packet modification are:

1. Denial of Service — An attacker sends ACK packets to the IAX Server simultaneously, making the IAX Server busy. The effect is the IAX Server can't establish a connection.

2. VoIP Spam — An attacker sends fake personal information that needs to be confirmed, leaking user data.

These threats can be prevented and handled if we know who is on the network and which computer is eavesdropping on IAX2 packets.

Eavesdropping Detection

Every packet goes through port 4569, so every router bypasses that port. Following Ram Dantu et al. [2], a proposed solution for eavesdropping is port-based MAC Address. Since routers communicate by MAC address, a packet can obtain the MAC Address of a router/computer that has port 4569 open. This uses additional overhead/bit header on the mini frame to store a key. The new mechanism for eavesdropping detection is presented in two sessions: signaling and media transmission.

1. Signaling Session

Bob sends packet 1.1 to collect the routing table that routes packets to Alice. Alice sends ACK + key to inform Bob that packet 1.1 was received. When packet 1.2 is received, Bob sends packet 1.2 to get the MAC address based on the routing table. Packet 1.3 is used to get the MAC Address that the packet is routed to.

Figure 5. Signaling session by Bob, Alice and router

Table 1. Activity Signaling Session

2. Media Flow Transmission Session

After the routing table is created and MAC Address obtained, Bob and Alice know which computer is safe to send packets to. The information is stored in the signaling data bits in the modified mini frame (Figure 6).

Figure 6. Modified Miniframe with overhead/bit header for signaling data

On Figure 6. A Modified on mini frame contain overhead/bit header for signaling data, which store a routing table and MAC address that packet routed.

When an eavesdropper tries to join, the attacker's MAC Address is listed in the ARP table. The IAX Server scans open ports in the listed MAC Address. When it scans port 4569, the attacker/client sends the ACK and key received in packet 1.4. The IAX Server checks the granted key, if it is not listed in the key granted table, then the attacker/client is suspected of eavesdropping.

Figure 7. Signaling session by Bob, Alice, Router and Attacker

Table 2. Activity Signaling Session (with Attacker)

By building a key chain at the signaling session and authenticating at the media transmission session, we can compare and compute a state indicating whether there is eavesdropping activity or none.

Figure 8. Packet Activity in Signaling Session

A state for get routing table is first step must client/server in signaling session (Figure 8), and the importance is Packet 1.3 after packet 1.2 and packet 1.5 send.

State for media transmission session, a IAX Server start eavesdropping detection with packet 2.1 that scanning port. The result is IAX server directly know an active client that join to IAX Server, with key that given in previous session, IAX Server can detect a client/attacker that try to eavesdrop (Figure 9).

Figure 9. Packet Activity in Signaling Session

Implementation

Using the OPNET Simulator, the presented topology was implemented.

Figure 10. Topology in OPNET Modeler

Figure 11. Modified packet state in data link layer of IAX2 Server

Figure 12. Parameters for simulation

Result

Another parameter on VoIP service is Quality of Service (QoS), which contains Jitter, Delay, and Throughput. With a modified mini frame and full frame, we can analyze the QoS after modifying the frame signaling and media transmission.

Figure 13. Delay in IAX Server 1

Figure 14. Delay in IAX Server 2

The result shows the delay of a packet captured in IAXServer1 and IAXServer2 is between 0.00001 and 0.00002 sec. Based on standard QoS reference tables, the VoIP application with the modified miniframe is of good quality — meaning the eavesdropping detection mechanism does not degrade the call quality to unacceptable levels.

Table 3. ITU Recommendation G.114[8]

Conclusion and Future Works

This research analyzed the IAX2 protocol and proposed a modified IAX2 mini frame that carries an additional key for eavesdropping detection. By building a key chain in the signaling session and authenticating in the media transmission session, the IAX Server can detect a client/attacker that tries to eavesdrop on the VoIP communication.

The QoS analysis on the OPNET Simulator showed that the modified frame maintains good call quality (packet delay between 0.00001 and 0.00002 sec). This provides a reference mechanism for implementing the IAX2 protocol with eavesdropping detection in future work.

References

[1] Adams B, Alden J, and Harris N (2009) Hacking VoIP - Protocols Attacks and Countermeasures. No Starch Press.

[2] Dantu R, Fahmi S, and Taylor B, Schulzrinnec H, Joao Cangussu J,(2009) Issues and challenges in securing VoIP. Computers & Security 28 (2009) 743–753.

[3] Rajagopalan V (2006) IAX2 Call Analyzer for Unsniff. Available at: www.unleashnetworks.com/lib/IAX2AnalyzerWhitepaper3.pdf [Accessed: May, 15th 2011].

[4] Spencer M, Miller F.W (2004) IAX Description [Online]. Available at: www.seteurocom.ru/materials/rus/iax.pdf [Accessed: May, 20th 201].

[5] Biermann E, Cloete E, and Venter L.M, ,(2001) A comparison of Intrusion Detection systems. Computers & Security 20 (2001) 676-683. Ram Dantu et al., VoIP as third generation communication after PSTN and cellular.

[6] Kolhar M.S, Abu-Alhaj M.M., Abouabdalla O, Wan T.C, and Manasrah, A.M,(2009) A comparison of Intrusion Detection systems. (IJCSIS) International Journal of Computer Science and Information Security. Vol. 6, No. 3

[7] M. Spencer, B. Capouch, E. Guy, Ed., F. Miller,K. Shumard,(2010) Independent Submission Request for Comments: 5456 IAX: Inter-Asterisk eXchange Version 2. ISSN: 2070-1721

[8] http://www.cisco.com/en/US/tech/tk652/tk698/technologies_white_paper09186a0080 0a8993.shtml. [Accessed, June, 1st 2011].

This is the author's paper from the Seminar Nasional Manajemen Teknologi XV (MMT-ITS, 2012), also available at ResearchGate.