Linksys PAP2 locked to Vonage, support people funny

Discussion in 'VOIP' started by Kyler Laird, Sep 8, 2004.

  1. Kyler Laird

    Kyler Laird Guest

    After learning that the Linksys RT32P2 I purchased was locked to
    Vonage, I returned it. While at Staples I noticed the Linksys
    PAP2. I asked a sales person about whether or not it was
    similarly locked. We noted that it did not list Vonage service
    under the minimum requirements and he encouraged me to just get
    it and return it if it didn't work.

    Well...I've been trying it. It does indeed appear to be an
    SPA-2000 under the hood. When it boots, it makes a TFTP request
    to ls.tftp.vonage.net for "/spa000F66A84007.xml". The Web
    interface is Linksys-branded but similar to the Sipura devices.

    One of the options is "Admin Login". When I tried this, I was
    unable to authenticate successfully. I called Linksys support
    in India. After a couple of people told me that there was no
    Web interface, I made a tunnel to the PAP2 and gave one of the
    technicians the URL. He tried it. Long silence.

    Finally he said that he had examined the URL and determined it
    to be a PAP2 simulator. Arrghh! It took a few more minutes
    to convince him that it's the non-existant Web interface on
    *my* PAP2 that he was seeing. (BTW, another technician told
    me to hit a reset button on the unit. There is none. She was
    sure it was "near the lights.")

    I finally got to talk to Senior Technician Gordon (in the
    US?). He quickly explained that it's locked to Vonage. It
    only took an hour on the phone to get the answer but it was at
    least a bit entertaining.

    BTW, it does appear that the unit can directly dial IP
    addresses without registering with Vonage. So you *could* use
    it on its own (especially on a phone with speed dial) or with
    Asterisk. It's not worth it to me though.

    Back goes another piece of Linksys hardware... I'll spend the
    extra $20 for hardware I control.

    --kyler
     
    Kyler Laird, Sep 8, 2004
    #1
    1. Advertising

  2. Kyler Laird

    Brendon Guest

    Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
    the spa000F66A84007.xml file yourself? Just an idea.

    "Kyler Laird" <> wrote in message
    news:...
    > After learning that the Linksys RT32P2 I purchased was locked to
    > Vonage, I returned it. While at Staples I noticed the Linksys
    > PAP2. I asked a sales person about whether or not it was
    > similarly locked. We noted that it did not list Vonage service
    > under the minimum requirements and he encouraged me to just get
    > it and return it if it didn't work.
    >
    > Well...I've been trying it. It does indeed appear to be an
    > SPA-2000 under the hood. When it boots, it makes a TFTP request
    > to ls.tftp.vonage.net for "/spa000F66A84007.xml". The Web
    > interface is Linksys-branded but similar to the Sipura devices.
    >
    > One of the options is "Admin Login". When I tried this, I was
    > unable to authenticate successfully. I called Linksys support
    > in India. After a couple of people told me that there was no
    > Web interface, I made a tunnel to the PAP2 and gave one of the
    > technicians the URL. He tried it. Long silence.
    >
    > Finally he said that he had examined the URL and determined it
    > to be a PAP2 simulator. Arrghh! It took a few more minutes
    > to convince him that it's the non-existant Web interface on
    > *my* PAP2 that he was seeing. (BTW, another technician told
    > me to hit a reset button on the unit. There is none. She was
    > sure it was "near the lights.")
    >
    > I finally got to talk to Senior Technician Gordon (in the
    > US?). He quickly explained that it's locked to Vonage. It
    > only took an hour on the phone to get the answer but it was at
    > least a bit entertaining.
    >
    > BTW, it does appear that the unit can directly dial IP
    > addresses without registering with Vonage. So you *could* use
    > it on its own (especially on a phone with speed dial) or with
    > Asterisk. It's not worth it to me though.
    >
    > Back goes another piece of Linksys hardware... I'll spend the
    > extra $20 for hardware I control.
    >
    > --kyler
     
    Brendon, Sep 8, 2004
    #2
    1. Advertising

  3. "Brendon" <> writes:
    > Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
    > the spa000F66A84007.xml file yourself? Just an idea.


    That is a very interesting idea. Anyone know if the format of that
    file defined anywhere?

    I haven't been able to find much information about constructing either
    Sipura or Bugtone config files. It would be nice to be able to
    program them via a file that I could keep under CVS instead of some
    web browser interface that doesn't allow me to save a copy of the
    phone's state.

    -wolfgang
    --
    Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/
     
    Wolfgang S. Rupprecht, Sep 9, 2004
    #3
  4. Kyler Laird

    Brendon Guest

    ***"When it boots, it makes a TFTP request to ls.tftp.vonage.net for
    "/spa000F66A84007.xml"***

    I'll hazard a guess that 00:0F:66:A8:40:07 is the MAC address of the
    Linksys, this is how a Cisco 7960 requests its config file from a TFTP
    server using Asterisk - the file name requested is specific to the MAC
    address.

    "Wolfgang S. Rupprecht"
    <> wrote in
    message news:...
    >
    > "Brendon" <> writes:
    >> Could you spoof ls.tftp.vonage.net to point to your tftp server and
    >> provide
    >> the spa000F66A84007.xml file yourself? Just an idea.

    >
    > That is a very interesting idea. Anyone know if the format of that
    > file defined anywhere?
    >
    > I haven't been able to find much information about constructing either
    > Sipura or Bugtone config files. It would be nice to be able to
    > program them via a file that I could keep under CVS instead of some
    > web browser interface that doesn't allow me to save a copy of the
    > phone's state.
    >
    > -wolfgang
    > --
    > Wolfgang S. Rupprecht http://www.wsrcc.com/wolfgang/
     
    Brendon, Sep 9, 2004
    #4
  5. Kyler Laird

    Kyler Laird Guest

    "Brendon" <> writes:

    >Could you spoof ls.tftp.vonage.net to point to your tftp server and provide
    >the spa000F66A84007.xml file yourself? Just an idea.


    That was my idea too. Take a look at the file though. I have a
    feeling that it's a signed config file. It probably references
    some firmware that's downloaded if it's different than the
    current version. I'd expect it to be signed too.

    Those are all guesses though. I'd love to discover that I'm
    wrong but I went ahead and had a couple *real* SPA-2000s air
    mailed to me this evening. I don't have time to mess around
    with "buying" hardware I don't control.

    --kyler
     
    Kyler Laird, Sep 9, 2004
    #5
  6. Kyler Laird

    Kyler Laird Guest

    I just got this from Jeremy McNamara who is apparently still upset
    at me for trying to provide help with his ticket handling system.
    The only thing for which he has shown any appreciation has been my
    posting of his information, so here goes...

    The PAP2 and the RT31P2 both are ABSOLUTELY NOT ~LOCKED~ to Vonage.

    I have personally reconfigured both units to talk to any SIP proxy,
    without opening the unit or otherwise violating the warranty

    If you were a nicer person I might give you a few really good tips. All
    I will say is the other people that responded to your post are on the
    right track.


    Jeremy McNamara

    --kyler
     
    Kyler Laird, Sep 9, 2004
    #6
  7. Kyler Laird

    Brendon Guest

    Can you post the file or email it to me?

    "Kyler Laird" <> wrote in message
    news:...
    > "Brendon" <> writes:
    >
    >>Could you spoof ls.tftp.vonage.net to point to your tftp server and
    >>provide
    >>the spa000F66A84007.xml file yourself? Just an idea.

    >
    > That was my idea too. Take a look at the file though. I have a
    > feeling that it's a signed config file. It probably references
    > some firmware that's downloaded if it's different than the
    > current version. I'd expect it to be signed too.
    >
    > Those are all guesses though. I'd love to discover that I'm
    > wrong but I went ahead and had a couple *real* SPA-2000s air
    > mailed to me this evening. I don't have time to mess around
    > with "buying" hardware I don't control.
    >
    > --kyler
     
    Brendon, Sep 9, 2004
    #7
  8. Kyler Laird

    Kyler Laird Guest

    "Brendon" <> writes:

    >Can you post the file or email it to me?


    Anyone can get the file through TFTP.

    --kyler
     
    Kyler Laird, Sep 9, 2004
    #8
  9. Kyler Laird

    Kyler Laird Guest

    I'm apparently a Usenet posting service now. It's not clear to
    me what the value of this is but perhaps someone else can use it.

    --kyler

    =================================================================

    From: Jeremy McNamara <>
    Subject: Detail

    *CLI>

    Sip read:
    INVITE sip: SIP/2.0
    Via: SIP/2.0/UDP 192.168.1.125:5060;branch=z9hG4bK-f85be36a
    From: <sip:p>;tag=96564193ae44263e
    To: <sip:>
    Call-ID: f2ce5b85-7638edb2@192.168.1.125
    CSeq: 101 INVITE
    Max-Forwards: 70
    Contact: <sip:pap2@192.168.1.125:5060>
    Expires: 240
    User-Agent: Linksys/PAP2-2.0.9(LSd)
    Content-Length: 422
    Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER
    Supported: x-sipura
    Content-Type: application/sdp

    v=0
    o=- 26868 26868 IN IP4 192.168.1.125
    s=-
    c=IN IP4 192.168.1.125
    t=0 0
    m=audio 16442 RTP/AVP 0 2 4 8 18 96 97 98 100 101
    a=rtpmap:0 PCMU/8000
    <snip>

    *CLI> sip show peer pap2
    * Name : pap2
    Secret : <Set>
    MD5Secret : <Not set>
    Context : NANPA
    Language :
    FromUser :
    FromDomain :
    Callgroup : (0)
    Pickupgroup : (0)
    Mailbox :
    LastMsgsSent : -1
    Dynamic : Yes
    Expire : 991
    Expiry : 900
    Insecure : No
    Nat : Always
    ACL : No
    CanReinvite : Yes
    PromiscRedir : No
    DTMFmode : rfc2833
    LastMsg : 0
    ToHost :
    Addr->IP : X.X.X.X Port 5060
    Defaddr->IP : 0.0.0.0 Port 5060
    Username : pap2
    Codecs : G.729A
    Status : UNKNOWN
    Useragent : Linksys/PAP2-2.0.9(LSd)
    Full Contact : sip:pap2@192.168.1.125:5060




    Jeremy McNamara


    P.S. Yes, it works thru my home NAT, as you can see
     
    Kyler Laird, Sep 9, 2004
    #9
  10. Kyler Laird

    Dustin Guest

    Care to share? Anyone by chance have Vonage and willing to give me
    their MAC address or a copy of their tftp downloaded "xml" file? I
    bought a couple of these units after the sales people at Fry's told me
    "they are not locked to Vonage, but are bundeled with it. You can use
    them with any VoIP provider." And I like a lot of other people would
    like to be able to use them with any VoIP provider. I opened up one of
    the units and was going to desolder the two flash roms and read them
    in an attempt to be able to "unlock" them. But that may not be
    necessary?

    Thanks,

    Dustin


    Kyler Laird <> wrote in message news:<>...
    > I just got this from Jeremy McNamara who is apparently still upset
    > at me for trying to provide help with his ticket handling system.
    > The only thing for which he has shown any appreciation has been my
    > posting of his information, so here goes...
    >
    > The PAP2 and the RT31P2 both are ABSOLUTELY NOT ~LOCKED~ to Vonage.
    >
    > I have personally reconfigured both units to talk to any SIP proxy,
    > without opening the unit or otherwise violating the warranty
    >
    > If you were a nicer person I might give you a few really good tips. All
    > I will say is the other people that responded to your post are on the
    > right track.
    >
    >
    > Jeremy McNamara
    >
    > --kyler
     
    Dustin, Sep 23, 2004
    #10
  11. Kyler Laird

    Kyler Laird Guest

    (Dustin) writes:

    >Care to share? Anyone by chance have Vonage and willing to give me
    >their MAC address or a copy of their tftp downloaded "xml" file?


    I posted the server and path for mine awhile ago.

    Good luck!

    --kyler
     
    Kyler Laird, Sep 24, 2004
    #11
  12. Kyler Laird

    Brendon Guest

    I checked this file out - its encrypted somehow, right? Just want to make
    sure we're on the same page.

    "Kyler Laird" <> wrote in message
    news:eek:...
    > (Dustin) writes:
    >
    >>Care to share? Anyone by chance have Vonage and willing to give me
    >>their MAC address or a copy of their tftp downloaded "xml" file?

    >
    > I posted the server and path for mine awhile ago.
    >
    > Good luck!
    >
    > --kyler
     
    Brendon, Sep 24, 2004
    #12
  13. Kyler Laird

    DevilsPGD Guest

    In message <75K4d.145140$> "Brendon"
    <> wrote:

    >I checked this file out - its encrypted somehow, right? Just want to make
    >sure we're on the same page.


    Yes...


    --
    Do not taunt zombie badgers
     
    DevilsPGD, Sep 24, 2004
    #13
  14. Kyler Laird

    Dustin Guest

    Kyler Laird <> wrote in message news:<>...
    > (Dustin) writes:
    >
    > >Care to share? Anyone by chance have Vonage and willing to give me
    > >their MAC address or a copy of their tftp downloaded "xml" file?

    >
    > I posted the server and path for mine awhile ago.
    >
    > Good luck!
    >
    > --kyler


    I made the assumption you did not have active service with Vonage
    currently under that mac address. I used a tftp client and pulled the
    file. Based on the first few characters of the file Salted__ I would
    have to agree with everyone that the file appears to be Salt
    encrypted...
     
    Dustin, Sep 24, 2004
    #14
  15. Kyler Laird

    Dustin Guest

    DevilsPGD <> wrote in message news:<_qM4d.1971284$>...
    > In message <75K4d.145140$> "Brendon"
    > <> wrote:
    >
    > >I checked this file out - its encrypted somehow, right? Just want to make
    > >sure we're on the same page.

    >
    > Yes...


    I was under the impression that all units downloaded a "firmware"
    file, not just the active ones. This is not that case. Virgin MAC's do
    not have a file. I downloaded a few different MAC's by incrementing
    the *known* good MAC and ran kDiff against the files. They are
    different. So maybe the salt somehow involves that MAC?
     
    Dustin, Sep 24, 2004
    #15
  16. Kyler Laird

    Kyler Laird Guest

    (Dustin) writes:

    >I made the assumption you did not have active service with Vonage
    >currently under that mac address.


    Ah! Yes, you're right. The file still seems to be able to configure
    the unit though, so I'd expect that if you can do something with it
    you'd have control.

    --kyler
     
    Kyler Laird, Sep 24, 2004
    #16
  17. Kyler Laird

    Dustin Guest

    Kyler Laird <> wrote in message news:<>...
    > (Dustin) writes:
    >
    > >I made the assumption you did not have active service with Vonage
    > >currently under that mac address.

    >
    > Ah! Yes, you're right. The file still seems to be able to configure
    > the unit though, so I'd expect that if you can do something with it
    > you'd have control.
    >
    > --kyler


    Well the Vonage website says something like "reboot your unit and do
    not unplug your it during the first 5 minutes... or you may end up
    with a dead unit..." that makes me think it might be firmware and
    reflashing the unit. Has anyone had Vonage and canceled? And did their
    unit revert to the way it was when you first got it after canceling?

    -dustin
     
    Dustin, Sep 24, 2004
    #17
  18. Kyler Laird

    DevilsPGD Guest

    In message <>
    (Dustin) wrote:

    >>>I checked this file out - its encrypted somehow, right? Just want to make
    >>>sure we're on the same page.

    >>
    >> Yes...

    >
    >I was under the impression that all units downloaded a "firmware"
    >file, not just the active ones. This is not that case. Virgin MAC's do
    >not have a file. I downloaded a few different MAC's by incrementing
    >the *known* good MAC and ran kDiff against the files. They are
    >different. So maybe the salt somehow involves that MAC?


    All units download files which can contain firmware+configuration. If a
    unit hasn't been activated there is no need to send it firmware or even
    configuration files, just enough to tell the device to try again later.


    --
    1989 - The movie "Batman," notches $100 million in 10 days,
    proving once and for all that the public can't get enough
    of men in tights.
     
    DevilsPGD, Sep 25, 2004
    #18
  19. Kyler Laird

    Ceccopeppe Guest

    Ok, I downloaded six spa<macaddress>.xml files. I've seen that they are
    really
    cripted (using mac address?) and my PAP2 does not validate the one loaded.
    So I wish i try using the Sipura configuration compile, SPC, available
    only on
    protected Sipura site so to compile a text file using macaddress as
    cripting
    key.
    Does someone have a copy of SPC, either for windows or for linux ?
    Thanks


    ##-----------------------------------------------#
    Article posted with Cabling-Design.com Newsgroup Archiv
    http://www.cabling-design.com/forum
    no-spam read and post WWW interface to your favorite newsgroup -
    comp.dcom.voice-over-ip - 1063 messages and counting
    ##-----------------------------------------------##
     
    Ceccopeppe, Nov 7, 2004
    #19
  20. Kyler Laird

    Dustin Guest

    What is SPC?

    (Ceccopeppe) wrote in message news:<xjmjd.2528693$>...
    > Ok, I downloaded six spa<macaddress>.xml files. I've seen that they are
    > really
    > cripted (using mac address?) and my PAP2 does not validate the one loaded.
    > So I wish i try using the Sipura configuration compile, SPC, available
    > only on
    > protected Sipura site so to compile a text file using macaddress as
    > cripting
    > key.
    > Does someone have a copy of SPC, either for windows or for linux ?
    > Thanks
    >
    >
    >
    > ##-----------------------------------------------##
    > Article posted with Cabling-Design.com Newsgroup Archive
    > http://www.cabling-design.com/forums
    > no-spam read and post WWW interface to your favorite newsgroup -
    > comp.dcom.voice-over-ip - 1063 messages and counting!
    > ##-----------------------------------------------##
     
    Dustin, Dec 2, 2004
    #20
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. The Rev [MCT]
    Replies:
    42
    Views:
    1,608
  2. Gary Dale
    Replies:
    15
    Views:
    4,704
    Marc H.Popek
    Mar 20, 2005
  3. Dan M

    Vonage/PAP2/Switch problems

    Dan M, Oct 25, 2005, in forum: VOIP
    Replies:
    4
    Views:
    2,420
    wkearney99
    Oct 27, 2005
  4. Simon

    Locked Vonage broadband router

    Simon, Jul 9, 2006, in forum: UK VOIP
    Replies:
    1
    Views:
    1,210
  5. joevan
    Replies:
    0
    Views:
    645
    joevan
    Jun 29, 2006
Loading...

Share This Page