[asterisk-biz] Open letter to digium, asterisk developers and consultants

[Trixter aka Bret McDanel]

On Mon, 2008-06-09 at 14:20 -0400, Jason Garland wrote:
> I usually try to avoid SIP providers using Asterisk for the same
> reasons. A good indication they are using Asterisk is if they offer
> IAX service. I usually take a look at a few SIP packets to check the
> User-Agent or Server headers before I decide they are Asterisk free.
> Another good indication of a good SIP provider is if they have
> published DNS SRV records, even better if they offer DNS NAPTR records
> too. SIP TCP and SIP TLS support are also bonuses. :)
> 


you can always fingerprint the sip stack, there are some responses from
the way that the sip stack in asterisk responds that while arent invalid
are somewhat unique, so even if the user agent header is changed you can
still tell what it is.  I discovered these while looking for actual
bugs, so surely someone else has noticed them too and a sip
fingerprinting device can be used.

But the point wasnt to say not to use asterisk, but rather to encourage
digium to change thier policies to be compliant with the spirit of the
gpl.

-- 
Trixter http://www.0xdecafbad.com     Bret McDanel
Belfast +44 28 9099 6461        US +1 516 687 5200
http://www.trxtel.com the phone company that pays you!