Linksys PAP2 locked to Vonage, support people funny

Discussion in 'VOIP' started by Kyler Laird, Sep 8, 2004.

  1. Kyler Laird

    Kyler Laird Guest

    After learning that the Linksys RT32P2 I purchased was locked to
    Vonage, I returned it. While at Staples I noticed the Linksys
    PAP2. I asked a sales person about whether or not it was
    similarly locked. We noted that it did not list Vonage service
    under the minimum requirements and he encouraged me to just get
    it and return it if it didn't work.

    Well...I've been trying it. It does indeed appear to be an
    SPA-2000 under the hood. When it boots, it makes a TFTP request
    to for "/spa000F66A84007.xml". The Web
    interface is Linksys-branded but similar to the Sipura devices.

    One of the options is "Admin Login". When I tried this, I was
    unable to authenticate successfully. I called Linksys support
    in India. After a couple of people told me that there was no
    Web interface, I made a tunnel to the PAP2 and gave one of the
    technicians the URL. He tried it. Long silence.

    Finally he said that he had examined the URL and determined it
    to be a PAP2 simulator. Arrghh! It took a few more minutes
    to convince him that it's the non-existant Web interface on
    *my* PAP2 that he was seeing. (BTW, another technician told
    me to hit a reset button on the unit. There is none. She was
    sure it was "near the lights.")

    I finally got to talk to Senior Technician Gordon (in the
    US?). He quickly explained that it's locked to Vonage. It
    only took an hour on the phone to get the answer but it was at
    least a bit entertaining.

    BTW, it does appear that the unit can directly dial IP
    addresses without registering with Vonage. So you *could* use
    it on its own (especially on a phone with speed dial) or with
    Asterisk. It's not worth it to me though.

    Back goes another piece of Linksys hardware... I'll spend the
    extra $20 for hardware I control.

    Kyler Laird, Sep 8, 2004
    1. Advertisements

  2. Kyler Laird

    Brendon Guest

    Could you spoof to point to your tftp server and provide
    the spa000F66A84007.xml file yourself? Just an idea.
    Brendon, Sep 8, 2004
    1. Advertisements

  3. That is a very interesting idea. Anyone know if the format of that
    file defined anywhere?

    I haven't been able to find much information about constructing either
    Sipura or Bugtone config files. It would be nice to be able to
    program them via a file that I could keep under CVS instead of some
    web browser interface that doesn't allow me to save a copy of the
    phone's state.

    Wolfgang S. Rupprecht, Sep 9, 2004
  4. Kyler Laird

    Brendon Guest

    ***"When it boots, it makes a TFTP request to for

    I'll hazard a guess that 00:0F:66:A8:40:07 is the MAC address of the
    Linksys, this is how a Cisco 7960 requests its config file from a TFTP
    server using Asterisk - the file name requested is specific to the MAC

    "Wolfgang S. Rupprecht"
    Brendon, Sep 9, 2004
  5. Kyler Laird

    Kyler Laird Guest

    That was my idea too. Take a look at the file though. I have a
    feeling that it's a signed config file. It probably references
    some firmware that's downloaded if it's different than the
    current version. I'd expect it to be signed too.

    Those are all guesses though. I'd love to discover that I'm
    wrong but I went ahead and had a couple *real* SPA-2000s air
    mailed to me this evening. I don't have time to mess around
    with "buying" hardware I don't control.

    Kyler Laird, Sep 9, 2004
  6. Kyler Laird

    Kyler Laird Guest

    I just got this from Jeremy McNamara who is apparently still upset
    at me for trying to provide help with his ticket handling system.
    The only thing for which he has shown any appreciation has been my
    posting of his information, so here goes...

    The PAP2 and the RT31P2 both are ABSOLUTELY NOT ~LOCKED~ to Vonage.

    I have personally reconfigured both units to talk to any SIP proxy,
    without opening the unit or otherwise violating the warranty

    If you were a nicer person I might give you a few really good tips. All
    I will say is the other people that responded to your post are on the
    right track.

    Jeremy McNamara

    Kyler Laird, Sep 9, 2004
  7. Kyler Laird

    Brendon Guest

    Can you post the file or email it to me?

    Brendon, Sep 9, 2004
  8. Kyler Laird

    Kyler Laird Guest

    Anyone can get the file through TFTP.

    Kyler Laird, Sep 9, 2004
  9. Kyler Laird

    Kyler Laird Guest

    I'm apparently a Usenet posting service now. It's not clear to
    me what the value of this is but perhaps someone else can use it.



    From: Jeremy McNamara <>
    Subject: Detail


    Sip read:
    INVITE sip: SIP/2.0
    Via: SIP/2.0/UDP;branch=z9hG4bK-f85be36a
    From: <sip:p>;tag=96564193ae44263e
    To: <sip:>
    Call-ID: [email protected]
    CSeq: 101 INVITE
    Max-Forwards: 70
    Contact: <sip:p[email protected]:5060>
    Expires: 240
    User-Agent: Linksys/PAP2-2.0.9(LSd)
    Content-Length: 422
    Supported: x-sipura
    Content-Type: application/sdp

    o=- 26868 26868 IN IP4
    c=IN IP4
    t=0 0
    m=audio 16442 RTP/AVP 0 2 4 8 18 96 97 98 100 101
    a=rtpmap:0 PCMU/8000

    *CLI> sip show peer pap2
    * Name : pap2
    Secret : <Set>
    MD5Secret : <Not set>
    Context : NANPA
    Language :
    FromUser :
    FromDomain :
    Callgroup : (0)
    Pickupgroup : (0)
    Mailbox :
    LastMsgsSent : -1
    Dynamic : Yes
    Expire : 991
    Expiry : 900
    Insecure : No
    Nat : Always
    ACL : No
    CanReinvite : Yes
    PromiscRedir : No
    DTMFmode : rfc2833
    LastMsg : 0
    ToHost :
    Addr->IP : X.X.X.X Port 5060
    Defaddr->IP : Port 5060
    Username : pap2
    Codecs : G.729A
    Status : UNKNOWN
    Useragent : Linksys/PAP2-2.0.9(LSd)
    Full Contact : sip:p[email protected]:5060

    Jeremy McNamara

    P.S. Yes, it works thru my home NAT, as you can see
    Kyler Laird, Sep 9, 2004
  10. Kyler Laird

    Dustin Guest

    Care to share? Anyone by chance have Vonage and willing to give me
    their MAC address or a copy of their tftp downloaded "xml" file? I
    bought a couple of these units after the sales people at Fry's told me
    "they are not locked to Vonage, but are bundeled with it. You can use
    them with any VoIP provider." And I like a lot of other people would
    like to be able to use them with any VoIP provider. I opened up one of
    the units and was going to desolder the two flash roms and read them
    in an attempt to be able to "unlock" them. But that may not be


    Dustin, Sep 23, 2004
  11. Kyler Laird

    Kyler Laird Guest

    I posted the server and path for mine awhile ago.

    Good luck!

    Kyler Laird, Sep 24, 2004
  12. Kyler Laird

    Brendon Guest

    I checked this file out - its encrypted somehow, right? Just want to make
    sure we're on the same page.
    Brendon, Sep 24, 2004
  13. Kyler Laird

    DevilsPGD Guest

    In message <75K4d.145140$> "Brendon"
    DevilsPGD, Sep 24, 2004
  14. Kyler Laird

    Dustin Guest

    I made the assumption you did not have active service with Vonage
    currently under that mac address. I used a tftp client and pulled the
    file. Based on the first few characters of the file Salted__ I would
    have to agree with everyone that the file appears to be Salt
    Dustin, Sep 24, 2004
  15. Kyler Laird

    Dustin Guest

    I was under the impression that all units downloaded a "firmware"
    file, not just the active ones. This is not that case. Virgin MAC's do
    not have a file. I downloaded a few different MAC's by incrementing
    the *known* good MAC and ran kDiff against the files. They are
    different. So maybe the salt somehow involves that MAC?
    Dustin, Sep 24, 2004
  16. Kyler Laird

    Kyler Laird Guest

    Ah! Yes, you're right. The file still seems to be able to configure
    the unit though, so I'd expect that if you can do something with it
    you'd have control.

    Kyler Laird, Sep 24, 2004
  17. Kyler Laird

    Dustin Guest

    Well the Vonage website says something like "reboot your unit and do
    not unplug your it during the first 5 minutes... or you may end up
    with a dead unit..." that makes me think it might be firmware and
    reflashing the unit. Has anyone had Vonage and canceled? And did their
    unit revert to the way it was when you first got it after canceling?

    Dustin, Sep 24, 2004
  18. Kyler Laird

    DevilsPGD Guest

    In message <>
    All units download files which can contain firmware+configuration. If a
    unit hasn't been activated there is no need to send it firmware or even
    configuration files, just enough to tell the device to try again later.
    DevilsPGD, Sep 25, 2004
  19. Kyler Laird

    Ceccopeppe Guest

    Ok, I downloaded six spa<macaddress>.xml files. I've seen that they are
    cripted (using mac address?) and my PAP2 does not validate the one loaded.
    So I wish i try using the Sipura configuration compile, SPC, available
    only on
    protected Sipura site so to compile a text file using macaddress as
    Does someone have a copy of SPC, either for windows or for linux ?

    Article posted with Newsgroup Archiv
    no-spam read and post WWW interface to your favorite newsgroup -
    comp.dcom.voice-over-ip - 1063 messages and counting
    Ceccopeppe, Nov 7, 2004
  20. Kyler Laird

    Dustin Guest

    What is SPC?
    Dustin, Dec 2, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.