Windows XP service pack 3 and outgoing RTP issues.

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi again,

Finally we have found the problem and it is neither about XP SP3 nor sip stack issue.

There seems to be a new kind of malware, which looks for processes that have keyword names such as SIP, VOIP and the names of well known sip clients. Once such an application is found to be running, the malware starts corrupting the data sent from these processes. When you have such an issue, you need to rename the binaries and your application will work fine. So far I heard this happening on a few XP machines and none on Vista or Windows 7 yet.

I am not sure about the source and common AV applications do not report anything suspicious.

Hope it helps to those who might come across this issue.


Regards
Syd



> Date: Fri, 29 Jan 2010 23:30:33 +0700
> From: nanang@xxxxxxxxx
> To: pjsip at lists.pjsip.org
> Subject: Re: Windows XP service pack 3 and outgoing RTP issues.
> 
> Hi Syd,
> 
> Honestly, got no clue for now.
> 
> However, I think the symptom should also happen for other endpoint
> types, not just PSTN. If so, perhaps you can try to make call to
> another pjsua using L16/PCM codec (and still avoid resampling). If the
> symptom was reproducible with this scenario, you probably could pin
> point the problem location using debugger by doing byte-comparison
> between frame being sent to recorder and 'the same' frame being sent
> to stream.
> 
> BR,
> nanang
> 
> 
> On Fri, Jan 29, 2010 at 7:27 PM, Syd Brearley <cherkazoo at live.co.uk> wrote:
> >
> >
> > ________________________________
> > Date: Fri, 29 Jan 2010 14:12:06 +0700
> > From: nanang@xxxxxxxxx
> > To: pjsip at lists.pjsip.org
> > Subject: Re: Windows XP service pack 3 and outgoing RTP issues.
> >
> > Hi Syd,
> >
> > Looking at this simple audio flow diagram:
> > ---
> > aud dev 16khz/PCM -> conf bridge 16khz/PCM --> stream 8khz/PCMU (garbled)
> >                                            +-> recorder 16khz/PCM (ok)
> > ---
> > the audio processing differences will be resampling 16->8 (in conf_bridge)
> > and (PCMU) encoding.
> > So, could you test again without resampling, i.e: running pjsua with
> > additional config "--clock-rate 8000" and "--snd-clock-rate 8000", and still
> > using PCMU.
> > BR,
> > nanang
> >
> >
> >
> > Hi Nanang,
> >
> > Thanks for the suggestion. I am sure I have tried it before, but this
> > morning requested another test using the suggested parameters. The capture
> > file I have received seems to be worse because even the beginning of
> > conversation seems to be garbled. If you have any other suggestions I can
> > get my colleagues to make another test shortly.
> >
> > The sip log and rtp capture is uploaded in the same location with the name
> > test_8000.zip
> >
> > Kind Regards
> > Syd
> >
> >
> >
> > ________________________________
> > Not got a Hotmail account? Sign-up now - Free
> > _______________________________________________
> > Visit our blog: http://blog.pjsip.org
> >
> > pjsip mailing list
> > pjsip at lists.pjsip.org
> > http://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org
> >
> >
> 
> _______________________________________________
> Visit our blog: http://blog.pjsip.org
> 
> pjsip mailing list
> pjsip at lists.pjsip.org
> http://lists.pjsip.org/mailman/listinfo/pjsip_lists.pjsip.org
 		 	   		  
_________________________________________________________________
We want to hear all your funny, exciting and crazy Hotmail stories. Tell us now
http://clk.atdmt.com/UKM/go/195013117/direct/01/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.pjsip.org/pipermail/pjsip_lists.pjsip.org/attachments/20100203/b07a651e/attachment.html>


[Index of Archives]     [Asterisk Users]     [Asterisk App Development]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Security]     [Bugtraq]     [Linux]     [Linux OMAP]     [Linux MIPS]     [Linux API]
  Powered by Linux