Scenario

This lab takes you into the world of voice communications on the internet. VoIP is becoming the de-facto standard for voice communication. As this technology becomes more common, malicious parties have more opportunities and stronger motives to control these systems to conduct nefarious activities. This challenge was designed to examine and explore some of the attributes of the SIP and RTP protocols.

Two artifacts ship with the lab:

• log.txt was generated by an unadvertised, passive honeypot on the internet, so every SIP message in it is hostile by definition. The honeypot's own address is masked as honey.pot.IP.removed, external addresses have octets replaced with X, trailing digits of phone numbers are replaced with X, and the MD5 in every authorization digest is replaced with MD5_hash_removedXXXXXXXXXXXXXXXX. Timestamps are UTC.
• Voip-trace.pcap was created by Honeynet members for this challenge on a separate lab network.

Note: these are two different environments, log.txt is the internet honeypot: it holds SIP requests only (no responses), spans 2010-05-02 to 2010-05-05, and involves two external sources. Voip-trace.pcap is a small lab network in 172.25.105.0/24 captured on 2010-05-01, and it holds SIP, RTP, RTCP and HTTP. Questions 2, 4, 5, 6, 7 and 8 are answered from the log. Questions 1, 3, 9, 10, 11, 12, 13 and 14 are answered from the capture. Each has its own SIP client, and they are not the same product.

The commands in this walkthrough are plain grep pipelines, exactly as the lab hints suggest. On Windows they run unchanged under WSL, Git Bash, or any Linux VM with the lab folder mounted.

Q1: What is the transport protocol being used?

What do we need to know?

A VoIP call is two conversations, not one. SIP carries the signalling: it sets the call up, negotiates what codec both ends will speak, and tears the call down. RTP carries the audio itself. They run on different ports and are dissected as different prot…