dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
26660

toro
join:2006-01-27
Scarborough, ON

1 edit

toro to pulsar777

Member

to pulsar777

Re: [Unlock] Unlocking Linksys SPA2102 adapter

I'm afraid the ATA doesn't do any traffic other than SIP registrations (I attached the traces filtered to contain only the packets from the ATA). Edit: removed at OP's request.
Probably the provider has provisioned it manually. So no luck unlocking it with this method.
If it was provisioned automatically, usually the ATA would download its configuration about a minute after boot up and then periodically according to a parameter set in the Provisioning tab. You can try to leave the capture running longer, but I doubt you will see more info. If you don't want to capture the traffic from other devices in the network, you can set a filter like "host 10.250.63.39" before you start the capture.
pulsar777
join:2009-12-21

pulsar777

Member

so in this case ATA probably manually provisioned by ISP. Is it possible configure new (unlocked) ATA with that SIP credentials I have already?

toro
join:2006-01-27
Scarborough, ON

toro

Member

If you have the SIP credentials you can configure another ATA, but what would be the purpose for that if you have a working one already ? Usually you can't use the same credentials on two or more ATAs at the same time.
pulsar777
join:2009-12-21

pulsar777

Member

I want configure additional VoIP number in this ATA, but its locked.

toro
join:2006-01-27
Scarborough, ON

toro

Member

So why not keep both ATAs and configure only the additional number(s) on the other one ?
pulsar777
join:2009-12-21

pulsar777

Member

I can do this way, but using extra hardware with lot of wires on table isn't very good.
Stewart
join:2005-07-13

Stewart to pulsar777

Member

to pulsar777
I tried to find some info from the capture, but had no luck:

The MAC address does not appear on Linksys site, so I assume that this is not a remotely customized unit. Please post exact model number (printed on bottom), e.g. SPA2102-EU.

The name sip.telenet.lv resolves to 193.111.244.67 and sip2.telenet.lv resolves to 193.111.244.69, but there were not any meaningful references to those names or addresses.

I also failed to find any posts about telenet.lv and VoIP, though I don't know Latvian or Russian; perhaps you can find something by searching in those languages.

A search for a weak SIP password, numeric or hex of up to 8 characters, failed.

The nonce indicates that Telenet is using a softswitch from Mera Systems (now Aloe Systems), but I failed to find any general provisioning info about them. I tried some plausible names, e.g. prov.telenet.lv, but none resolved.

Does Telenet offer a softphone or smartphone SIP app? If so, it should be easy to extract the SIP password.

toro
join:2006-01-27
Scarborough, ON

toro

Member

said by Stewart:

A search for a weak SIP password, numeric or hex of up to 8 characters, failed.

The OP indicated that he actually has the SIP credentials.
Stewart
join:2005-07-13

Stewart

Member

said by toro:

The OP indicated that he actually has the SIP credentials.

Well,
said by pulsar777:

assuming that I will have the SIP credentials.

So I presume that he doesn't have them yet.

With the credentials, the solution seems simple: program them into the unlocked adapter, shut down the old one and test. Once it passes, the second line can be set up as desired, and when all is working correctly, the old adapter can be reset and repurposed, provided that it doesn't have "protect IVR factory reset" set.
pulsar777
join:2009-12-21

4 edits

pulsar777 to Stewart

Member

to Stewart
the model is SPA2102. The SIP domain does not belong to the current provider that provide the service. Perhaps voip service and sip domain was inherited from previous ISP, they don't offer softphone or smartphone SIP apps. I have sip details except the passw.
Stewart
join:2005-07-13

1 recommendation

Stewart

Member

If your provider left the provisioning settings at factory default, either because he configured manually, or he did an autoprovision over his own LAN, then you should be able to get the device to pull a config file by TFTP, which would allow you to reset the admin password, or to set up Line 2 without disturbing the current config at all. This is activated by sending option 66 in the DHCP ACK.

If you don't already have suitable DHCP and TFTP servers, TFTPD32 should do the job.

»www.mik.ua/products/spa9 ··· uide.pdf
»tftpd32.jounin.net/tftpd ··· faq.html

toro
join:2006-01-27
Scarborough, ON

toro

Member

Interesting idea, never thought of this one.
pulsar777
join:2009-12-21

pulsar777 to Stewart

Member

to Stewart
but how to find TFTP server IP address?
Stewart
join:2005-07-13

Stewart

Member

When the ATA receives its IP address by DHCP, it looks for option 66 in the DHCP ACK. If this is present, it is taken as the IP address of a TFTP server, and the ATA (with default provisioning settings) will attempt to fetch a file named spa2102.cfg from that TFTP server.

If you are merely trying to see if this scheme is workable, you don't need to actually set up a TFTP server; just have the device fetch its IP address from a DHCP server that offers option 66. If you then see (e.g. with Wireshark) TFTP requests being made to the IP address in option 66, then you will know that provisioning by this means is possible.

Be careful not to set up the new DHCP server in conflict with your existing one. One way to avoid this is to bind the new server to a second NIC on your PC, to which the ATA is attached. If you have only one NIC, either disconnect from your normal LAN when doing this test, or temporarily disable the old DHCP server and set the new one to be compatible.
pulsar777
join:2009-12-21

pulsar777

Member

I'm not sure how to configure tftpd32 DHCP server for that.
Stewart
join:2005-07-13

Stewart

Member

said by pulsar777:

I'm not sure how to configure tftpd32 DHCP server for that.

I've not used this myself, but the FAQ says you can edit the .ini file to e.g.:
AddOptionNumber1=66
AddOptionValue1=10.250.63.123
(Substitute actual address where TFTPD32 is running.)

You can look at the DHCP transactions with Wireshark to confirm that this is working as expected.
pulsar777
join:2009-12-21

pulsar777

Member

how works SIP authentication in SPA? I want move sip account from SPA to FritzBox 7140 wireless router which supports VoIP.

toro
join:2006-01-27
Scarborough, ON

toro

Member

If you are thinking of getting the SIP credentials from the SPA, it's not possible. It will not give you the passsword(s).
pulsar777
join:2009-12-21

pulsar777

Member

this ata doesn't use config at all, as preconfigured manually?
Stewart
join:2005-07-13

Stewart

Member

Did you try to unlock or configure your SPA2102 with DHCP option 66? If so, what went wrong?
pulsar777
join:2009-12-21

pulsar777

Member

I filled DCHP tab of tftpd32 with details, add option you mentioned into the ini file, run it and sniffed traffic when ATA powered on, but didn't find anything that pointed to a .cfg file.
Stewart
join:2005-07-13

Stewart

Member

said by pulsar777:

I filled DCHP tab of tftpd32 with details, add option you mentioned into the ini file, run it and sniffed traffic when ATA powered on, but didn't find anything that pointed to a .cfg file.

Please confirm that the DHCP ACK received by the ATA contained option 66 in the proper format.
pulsar777
join:2009-12-21

pulsar777

Member

I'm not sure about this, added into DHCP tab tftpd32 settings from my default network adapter (IP address, subnet mask, default gateway) and the additional options. I'm not sure how this additional DHCP server can work at the same time with default DHCP?
I tried click Release settings on network adapter, this cause adapter to discard DHCP network settings, then disconnect from the network, but then network connection is lost.

toro
join:2006-01-27
Scarborough, ON

toro

Member

You're not supposed to use your default DHCP server. You should have only the ATA and your computer connected to the network (hub) and let the ATA get an IP address from tftp32
pulsar777
join:2009-12-21

4 edits

pulsar777

Member

I did this, in tftpd32 dhcp "additional option" specified IP address of PC and port 66. Capture have 'Parameter request list' where specfied line 66=TFTP Server Name. But I didn't find address of this TFTP.
Stewart
join:2005-07-13

Stewart

Member

The DHCP server that answered the ATA's request does not appear to be the one that you set up. It would be simplest if for this test, you disconnect your hub from the rest of your network, leaving only the ATA and your PC (that is running your DHCP server) connected.

Also, your network seems to be quite complicated, with both public (91.x.x.x) and private (10.x.x.x) on the same LAN. If your PC has more than one NIC, make sure that your DHCP server is bound to the correct interface. Or, temporarily disable any interfaces not used for this test.
pulsar777
join:2009-12-21

1 edit

pulsar777

Member

my network is very simple, only ATA and one PC is connected to hub, and cable modem is connected to uplink port on a hub. PC have one network card. Private IPs assigned to ATA. There're also visible names of few .bin files, which belong to a cable config files, I guess. But one file named D3-SIP.bin
Stewart
join:2005-07-13

Stewart

Member

Just temporarily unplug the connection from cable modem to hub, start up the DHCP server on your PC, start a Wireshark capture, then reboot the ATA. Your DHCP server should answer the requests from the ATA and put option 66 in the ACK.

Once you have that working correctly, you should see the ATA then make a TFTP request to the address you send in the option 66. If it does, i.e. the provisioning settings were left at defaults by your provider, you should be able to send it a config file to reset the admin password or make any other desired changes.

To keep things simple, your TFTP server should assign an address to the ATA that is in the same subnet as the PC. (If the ATA gets a 10.x.x.x address and the PC has a 91.x.x.x address, the ATA won't be able to talk to the PC, with the cable modem disconnected.)
pulsar777
join:2009-12-21

pulsar777

Member

I did test with cable modem unplugged from hub. It show TFTP server name with IP specified in dhcp server tab, and config file name /spa2102.cfg
But I dont know where I can get this file, and it settings. If I upload new config, then the old settings (programmed manually) will be removed, and ATA will not work.
Stewart
join:2005-07-13

Stewart

Member

This is looking good.
said by pulsar777:

If I upload new config, then the old settings (programmed manually) will be removed, and ATA will not work.

The config file should not wipe anything out. It will only change the parameters that are specified in the file. For example, this file:
<?xml version="1.0" encoding="UTF-8"?>
<flat-profile>
 <Admin_Passwd ua="na">1234</Admin_Passwd>
</flat-profile>
 
should change the admin password to 1234 and leave everything else unchanged.