Speaker 1: Welcome to the deep dive. So think about this for
Speaker 1: a second. Imagine you can like totally control your entire
Speaker 1: communication system, really shape it into something powerful, precise, totally
Speaker 1: customized for you, like turning your phone system into well,
Speaker 1: the source we're using calls it a digital Samurai sord.
Speaker 2: Right, a samurai sword, I like that, And today that's
Speaker 2: exactly what we're diving into. Asterisk. It's this open source
Speaker 2: PBX private branch exchange, and its capabilities are pretty incredible, Okay.
Speaker 2: Our mission really is to unpack the basics, figure out
Speaker 2: how it's kind of revolutionizing communication and look at some
Speaker 2: honestly surprising uses like running a whole virtual call center
Speaker 2: or even yeah.
Speaker 1: Security audits, purity audits. Okay, interesting, and yeah you mentioned
Speaker 1: our source. We're digging into Asterisk hacking toolkit and live
Speaker 1: CD sounds pretty technical.
Speaker 2: It is, yeah, but fascinating stuff. Get ready for some
Speaker 2: some real aha moments because this view on telecoms, Yeah,
Speaker 2: it might genuinely surprise you.
Speaker 1: All right, let's do it. So foundation first, what exactly
Speaker 1: is a PBX break it down for us?
Speaker 2: Okay, right, So basically, a PBX is the gear, the
Speaker 2: equipment that handles phone switching for a private business like
Speaker 2: an internal switchboard exactly. It keeps your internal calls, you
Speaker 2: talking to a colleague, say, totally inside your network. And
Speaker 2: it also manages all the connections going out to the
Speaker 2: regular phone network.
Speaker 1: Gotcha, And I bet these things have changed a lot.
Speaker 1: I remember hearing that, like before the big Bell system
Speaker 1: breakup in eighty four, PBXs were massive, huge, like.
Speaker 2: Room size sometimes. But after the breakup, Yeah, they shrank
Speaker 2: like crazy. The source says, from the size of a
Speaker 2: couch to the size of a briefcase.
Speaker 1: Wow.
Speaker 2: And that shrinkage. It just flooded the market with new
Speaker 2: systems and suddenly we got all these features we just
Speaker 2: expect now, voicemail, interactive menus, call waiting, caller ID, even
Speaker 2: music on hold. It really really changed how businesses communicated.
Speaker 1: But I imagine that explosion of options created its own problems.
Speaker 2: Right Debfinitely A big one was vendor lock in. See
Speaker 2: each company each vendor often had their own special phones.
Speaker 1: So company Ex's phone wouldn't work with company wise system.
Speaker 2: Exactly, total headache for businesses, and sometimes vendors would set
Speaker 2: things up and then just disappear, leaving customers totally stranded.
Speaker 2: If something went wrong.
Speaker 1: Ouch. Okay, so that sounds like a perfect setup for
Speaker 1: something disruptive to come along, like voiceover IP VoIP.
Speaker 2: Precisely, VoIP really shakes things up. The core idea is
Speaker 2: sending your voice calls over your existing data networks, your
Speaker 2: computer network, and.
Speaker 1: The big draw there is cost I assume.
Speaker 2: Oh yeah, often these calls can be basically free or
Speaker 2: very close to it.
Speaker 1: How does that work though, squeezing voice onto a data line.
Speaker 2: It's all about compression using things called codex. Think of
Speaker 2: them like ZIP files for your voice. Okay, So a
Speaker 2: standard old phone call using something called MA law took
Speaker 2: up about sixty four kilobits per second, which meant a
Speaker 2: T one line pretty common back then, could only handle
Speaker 2: maybe twenty four calls at once.
Speaker 1: Okay, twenty four calls. It seems limiting.
Speaker 2: It was, but with newer codex those numbers just shoot up.
Speaker 2: Take G point seventy twenty nine. That drops the bandwidth
Speaker 2: need down to just eight kbps.
Speaker 1: Wow, big difference.
Speaker 2: Huge. Suddenly that same T one line handles one hundred
Speaker 2: and ninety two calls, though that one needs a license.
Speaker 2: But then you get really extreme ones like LPC.
Speaker 1: Ten LPC ten. What's that one like?
Speaker 2: Okay, this one's tiny two point five kbpcs. It's like
Speaker 2: six hundred and fourteen calls on that same T one
Speaker 2: line sixt fourteen.
Speaker 1: That's insane efficiency. But what's the catch? What does it
Speaker 1: sound like?
Speaker 2: Well, this is where the source has that memorable detail.
Speaker 2: It apparently often sounds like two whales making mating calls.
Speaker 1: Chuckles seriously whales.
Speaker 2: Yep intelligible supposedly, but ah yeah, not exactly professional sounding,
Speaker 2: probably not. But it shows you right, how those early
Speaker 2: VoIP engineers were just pushing the absolute limits, prioritizing cost
Speaker 2: savings over perfect audio quality. It's a clear trade off.
Speaker 2: More compression lower quality makes sense.
Speaker 1: So besides compression and cost, what else did VIP really unlock?
Speaker 2: Mobility? That's the other huge one. What happens when your
Speaker 2: team isn't all in one building.
Speaker 1: Right, remote work, traveling salespeople exactly?
Speaker 2: With voyip, your phone calls can follow you anywhere you
Speaker 2: have a data connection, home broadband, the office network. Even
Speaker 2: the source mentions Wi Fi at a local drinking establishment.
Speaker 1: Lefs, so your pub becomes your office extension.
Speaker 2: Kinda yeah, your sales team could be all over the country.
Speaker 2: But their phone number is still just an extension on
Speaker 2: the company PBX. They get voicemail, all the features, just
Speaker 2: like they were sitting at their desk.
Speaker 1: That flexibility is massive for how businesses can operate now.
Speaker 1: But it's worth pointing out VOYAP itself isn't just an
Speaker 1: asterisk thing, is it?
Speaker 2: Oh? Definitely not. Traditional PBX makers, the big phone companies,
Speaker 2: they've all adopted VOYP too. It's become pretty standard.
Speaker 1: But asterisk it came from a different place, didn't it.
Speaker 1: The origin store is pretty cool.
Speaker 2: It really is. Back in nineteen ninety nine, this guy,
Speaker 2: Mark Spencer, he needed a PBX for his own company. Okay,
Speaker 2: looked around, found everything cost an armor a leg sound familiar. Yeah,
Speaker 2: So what does he do? Just decides to build his
Speaker 2: own from scratch.
Speaker 1: Wow, just build the phone system.
Speaker 2: Yep. Now the source material we're using, it's honest. It
Speaker 2: says asterisk is hard.
Speaker 1: Okay, good to know, not necessarily plug and play.
Speaker 2: Not initially no ye. But it also says once you
Speaker 2: become familiar with its intricacies, everything suddenly starts to make sense,
Speaker 2: which is kind of true for a lot of powerful
Speaker 2: open source stuff, right.
Speaker 1: Yeah, that tracks steep learning curve, but big payoff.
Speaker 2: Exactly, and that payoff the real world advantages they're huge.
Speaker 2: Think about virtual.
Speaker 1: Call centers right before VoIP, that meant tons of physical
Speaker 1: space or paying a fortune to forward calls to people's
Speaker 1: homes exactly.
Speaker 2: But with Asterisk and VoIP, a call center can run
Speaker 2: with barely any physical office. Agents just need broadband wherever
Speaker 2: they are.
Speaker 1: And that's not just for call centers, right, and any
Speaker 1: company with remote workers, any mobile workforce.
Speaker 2: Yeah, it translates directly into cost savings too. Right, if
Speaker 2: your company already has data links between buildings or cities.
Speaker 1: You just route the voice calls over those existing links.
Speaker 2: BINGO, save money, free up your old phone lines. Plus,
Speaker 2: think about how many people have phones, way more than
Speaker 2: have reliable computer access sometimes the digital divide. Right. Sure,
Speaker 2: Asterisk lets you build voice based applications that can reach
Speaker 2: almost anyone. It dramatically expands who you can communicate with.
Speaker 1: Okay, So if people are listening and thinking this sounds interesting,
Speaker 1: where do they go to learn more?
Speaker 2: Good question. Www dot asterisk dot org is the main
Speaker 2: spot downloads news, developer info and www dot digm dot com.
Speaker 2: That's Mark Spencer's company, The Driving Force behind Asterisk they
Speaker 2: offer training hardware, that.
Speaker 1: Kind of stuff, got it, asterisk dot org and digim
Speaker 1: dot com. Okay, so we've painted this picture of asterisks potential.
Speaker 1: Let's say someone's listening and thinking, right, I want to
Speaker 1: build my own voice kingdom. Where do they even start
Speaker 1: with the hardware? What bits and pieces do you need?
Speaker 2: Okay? Hardware? First up the server. Interestingly, the Asterisk software
Speaker 2: itself tiny, doesn't need much storage really, and then you
Speaker 2: start adding things voice prompts for menus to press one
Speaker 2: for sale.
Speaker 1: The IVR right Interactive Voice Response.
Speaker 2: Exactly, and of course voicemail. That's when the storage footprint
Speaker 2: starts to grow. You need to plan based on how
Speaker 2: many users you'll have how much voicemail they might save.
Speaker 1: Okay, so server space depends on usage. What about the
Speaker 1: phones themselves? Do you need special IP phones?
Speaker 2: You can use dedicated IP phones, yeah, like the Cisco
Speaker 2: seven nine sixties mentioned in the source. But there's also
Speaker 2: this clever little gadget called an ATA Analog Telephone.
Speaker 1: Adapter AKA what's that do?
Speaker 2: It's basically the Source calls it the bridge between the
Speaker 2: world of analog telephones and the world of VoIP.
Speaker 1: Ah. So let's you plug in a regular old phone
Speaker 1: pretty much like.
Speaker 2: The one you might have at home, plug it into
Speaker 2: the ATA, plug the ATA to your network, and boom
Speaker 2: it talks of VOYIP. They're usually cheaper than ipphones.
Speaker 1: That's smart leverage existing hardware.
Speaker 2: Yep. They work with most standard analog phones, but not
Speaker 2: those proprietary digital phones from old pbx's or really old
Speaker 2: rotary dial phones. Why not rotary because apparently pulse diyling
Speaker 2: is an obsolete protocol for most atas they expect touchstones.
Speaker 1: Huh okay, good to know. No rotary dialing on your
Speaker 1: fancy OIP system. What if you want to connect analog
Speaker 1: phones directly to the server, though maybe for more control.
Speaker 2: For that, you'd use interface cards like digitm sells cards
Speaker 2: that can handle anywhere from one analog phone up to
Speaker 2: like ninety six on a single card. Wow okay, and
Speaker 2: these cards often do support pulse diyling for those vintage
Speaker 2: phone enthusiasts. You can also get cards to connect to preis.
Speaker 1: Pre I's primary rate interfaces. Those are the big digital
Speaker 1: lines from the phone company right now.
Speaker 2: Yeah, exactly, high capacity usually twenty three or twenty four
Speaker 2: voice channels. You can use a channel bank to split
Speaker 2: that PI signal out to individual analog phones or lines
Speaker 2: if you need to.
Speaker 1: Okay, so hardware sorted server phones or atas, maybe interface cards.
Speaker 1: Now the network voice sounds like it would be pretty
Speaker 1: demanding on the network.
Speaker 2: It can be. Yeah, remember that oilaw codec sixty four kbps,
Speaker 2: which is eight kilobytes per second.
Speaker 1: Okay, eight kbbs doesn't sound like much on its own,
Speaker 1: not for.
Speaker 2: One call, No, but scale it up. Imagine say twenty
Speaker 2: five hundred simultaneous calls. Now you're talking a constant stream
Speaker 2: of twenty megabytes per second just for voice traffic. That
Speaker 2: definitely highlights why your network backbone needs to be solid.
Speaker 1: Right, So, if you've got voice and regular computer data
Speaker 1: flying around, how do you stop like a big file
Speaker 1: download for making your phone calls sound terrible? I guess
Speaker 1: vlands come into play here. Virtual local area networks absolutely essential.
Speaker 2: Vlands are basically a software trick in your network switches.
Speaker 2: They let you create virtual partitions on the same physical network,
Speaker 2: so you.
Speaker 1: Can put all the phones on one virtual network and
Speaker 1: all the computers on another.
Speaker 2: Exactly keep the voice traffic totally separate from the data traffic.
Speaker 2: That massive file transfer won't interfere with cul quality then,
Speaker 2: and this separation it's also a big win for security.
Speaker 1: How so security for voice?
Speaker 2: Yeah, just like any data VOYP traffic can be sniffed.
Speaker 2: There are automated tools out there. The source mentions vomit
Speaker 2: and cane enable that attackers can use to just listen
Speaker 2: in and record calls. But if your voice traffic is
Speaker 2: on its own separate VLAN, it creates a barrier, makes
Speaker 2: it way harder for someone on the MAINTATA network to
Speaker 2: just casually intercept your calls. The absolute best practice a
Speaker 2: whole second dedicated ethernet network just for phones, or at
Speaker 2: least a very strictly controlled VLAN.
Speaker 1: Okay, isolate the voice traffic makes sense. What about optimizing
Speaker 1: things over like wider connections between offices.
Speaker 2: When optimization right on those wide area networks, you often
Speaker 2: use bandwidth shaping, basically telling the network what traffic is.
Speaker 1: Most important, so you prioritize the voice.
Speaker 2: You can two main ways. You can dedicate a chunk
Speaker 2: of bandwidth just for VoIP say one megabit is always
Speaker 2: reserved for voice guarantees service, but it's inefficient if no
Speaker 2: one's on.
Speaker 1: The phone wasted bandwidth then potentially.
Speaker 2: The other way is just to prioritize VoIP let data
Speaker 2: use one hundred percent if it needs it. But if
Speaker 2: a voice pack it comes along, it jumps to the
Speaker 2: front of the line. More efficient use of bandwidth, but
Speaker 2: maybe slightly less guaranteed quality than pure dedication.
Speaker 1: It's a trade off efficiency versus guarantees. Got it okay,
Speaker 1: network's tuned. How do you actually get Asterisk installed and running?
Speaker 1: What's the typical approach?
Speaker 2: Well, there are quite a few Linux distributions built specifically
Speaker 2: around Asterisk. One of the most popular, especially for ease
Speaker 2: of use, has been tricks Box, trix Box Yeah start
Speaker 2: out back in two thousand and five. Is Asterisk get
Speaker 2: home really designed to make it simpler for people? It
Speaker 2: got acquired by a company called Finality, and Yeah became
Speaker 2: super popular, tens of thousands of downloads a month. Apparently
Speaker 2: big reason.
Speaker 1: It's a web interface, ah, a guy that always helps
Speaker 1: lower the barrier to entry definitely.
Speaker 2: Trick Box uses tools like PHP can fig, Asterisk, canfig Editor,
Speaker 2: and free pbx. These give you a web page you
Speaker 2: can log into, just type the server's IP address in
Speaker 2: your browser and manage stuff like call recording, conference calls
Speaker 2: voicemail all through menus and buttons.
Speaker 1: Sounds pretty user friendly for something potentially complex.
Speaker 2: It is, but here's a really critical security point from
Speaker 2: the source material.
Speaker 1: Oh what's that?
Speaker 2: That tricks box management system the web in face It
Speaker 2: does not use SSL encryption by default.
Speaker 1: Wait seriously, no HTTPS.
Speaker 2: Nope, which means when you log in your username and
Speaker 2: password they're sent in plaintext. Anyone sniffing the network can
Speaker 2: see them. Wow.
Speaker 1: Okay, that's a massive security hole to be aware of
Speaker 1: if you're using that interface.
Speaker 2: Absolutely huge. Definitely something to lock down immediately if you
Speaker 2: go that route. And while that interface like free pbx
Speaker 2: makes things easier.
Speaker 1: To start, there's a butt coming, isn't there?
Speaker 2: There is? You can grow out of it quickly. Frameworks
Speaker 2: like that simplify things, but they also constrain you. If
Speaker 2: you want to do something really custom, something the framework
Speaker 2: wasn't designed for, it can become a real pain or
Speaker 2: just impossible through the GUI.
Speaker 1: So for real power users, you eventually need to get
Speaker 1: your hands dirty with the actual fig.
Speaker 2: File pretty much. Yeah, you need to dive into the
Speaker 2: core configuration.
Speaker 1: Okay, so how is that structure? Is it just one
Speaker 1: giant file?
Speaker 2: No, thankfully not Asterisk uses many small configuration files, all
Speaker 2: interconnected to one another, like over sixty of them.
Speaker 1: Sixty. Wow, that sounds complicated.
Speaker 2: It sounds it, but there's a logic to it and
Speaker 2: a big advantage. If you mess up one setting in
Speaker 2: one file, it's less likely to bring the entire system down.
Speaker 2: It helps prevent, as the source puts it, the entire
Speaker 2: proverbial house of cards come crashing down.
Speaker 1: Ah, modularity, that makes sense. So where does the call
Speaker 1: logic live?
Speaker 2: That's mainly in the dial plant. Every single call, no
Speaker 2: matter where it comes from or where it's going, goes
Speaker 2: through the dial plant. It's made up of things called contexts, extensions,
Speaker 2: and variables.
Speaker 1: Okay, contexts, extensions, variables. Now, the source makes a really
Speaker 1: big deal about clarifying something here. Extensions versus channels. They're
Speaker 1: not the same thing.
Speaker 2: Not at all, and yet it's fundamental to under standing asterisk.
Speaker 2: Extensions are the numbers assigned to devices or features like
Speaker 2: your desk phone might be extension one oh.
Speaker 1: One, okay, the logical number right.
Speaker 2: Channels on the other end, are the actual connections to
Speaker 2: those devices, the communication pathways.
Speaker 1: How does that work in practice? Give me an example.
Speaker 2: Sure, you could have one physical phone on your desk,
Speaker 2: but maybe you set it up so it rings. If
Speaker 2: someone dials extension one oh one or Extension one oh
Speaker 2: two or Extension five hundred. Maybe a group put number
Speaker 2: three different.
Speaker 1: Extensions but only one phone. One physical connection.
Speaker 2: Exactly three logical extensions, but only one channel the connection
Speaker 2: to your single phone. Extensions are logical channels are physical
Speaker 2: or virtual connections? Crucial difference?
Speaker 1: Got it? That clarifies things a lot? So the dial
Speaker 1: plan uses these. Can you walk through a super simple
Speaker 1: call flow?
Speaker 2: Yeah, okay, basic call comes in first? Maybe you answer
Speaker 2: the call, then play a message using background like that
Speaker 2: thank you for calling, Congloma Corp sound.
Speaker 1: File right while listening for exactly.
Speaker 2: Maybe the message says press one hundred for tech support.
Speaker 2: If the caller presses one hundred, the dial plan uses
Speaker 2: the dial command. Maybe dialis IP ten to connect them
Speaker 2: to the phone at extension ten. If they don't press
Speaker 2: anything and the message finishes, maybe you just hang up.
Speaker 2: You can also jump between different parts of the dial
Speaker 2: plan using go to. It's very step by step like.
Speaker 1: Programming a flow chart. Almost I can see how you
Speaker 1: can build complex menus. Is there a more like script
Speaker 1: like way to write.
Speaker 2: These there is. Yeah, it's called extensions dot al, the
Speaker 2: Asterisk extensions language developed by Digitium. The source says it's
Speaker 2: syntactically much more powerful than the traditional extensions dot com
Speaker 2: file format.
Speaker 1: AEL sounds like it might appeal more to programmers.
Speaker 2: Definitely if you're used to scripting in say Perl or Python,
Speaker 2: AEL syntax might feel more natural, more powerful for complex logic.
Speaker 1: Cool. Okay, so you've got your internal system configured. Now,
Speaker 1: how do you connect this astrisk kingdom to the rest
Speaker 1: of the world. What protocols does it use?
Speaker 2: Astrisk supports a whole bunch, but for VoIP, the two
Speaker 2: big ones you'll run into are SIP and IAX two.
Speaker 1: SIP Session Initiation Protocol. That one sounds familiar. It's pretty standard.
Speaker 2: SEP is the most common VoIP protocol. It's an official
Speaker 2: Internet standard. Pretty much every VoIP phone, every VoIP service
Speaker 2: provider supports SIP, so.
Speaker 1: That's the one you'd usually use often.
Speaker 2: Yes, but it has its quirks, complexities, especially when you're
Speaker 2: trying to get calls across different networks through firewalls.
Speaker 1: Well kind of quirks. What goes wrong with CP?
Speaker 2: Well, the main thing is that SIP actually uses two protocols.
Speaker 2: SIP itself is just for setting up the call, tearing
Speaker 2: it down, managing the session.
Speaker 1: Okay, the control signals.
Speaker 2: Right, But the actual voice, your conversation that travels over
Speaker 2: a different protocol called RTP Real Time Transport Protocol.
Speaker 1: Two protocols for one call. Sounds like it could get confusing.
Speaker 2: It can, especially for firewalls and neat routers network address translation.
Speaker 2: You know the thing most home routers do. They get
Speaker 2: really confused by CIP. Sometimes the sipart works the call connects,
Speaker 2: but the RTP part the audio gets blocked, so you
Speaker 2: get silence. The source calls that the audiopath will not
Speaker 2: be carrying audio.
Speaker 1: Dead air frustrating any other SIP issues.
Speaker 2: Yeah, Sometimes GTMF tones the keypad beeps when you press
Speaker 2: numbers can get messed up. The source says, certain codex
Speaker 2: mangle the audio enough that the other end doesn't recognize
Speaker 2: the tones correctly. I think trying to navigate an automated
Speaker 2: menu and it just doesn't register your keypresses.
Speaker 1: Okay, so SIP is standard but can be tricky with
Speaker 1: networks and sometimes tones. What's the alternative? You mentioned IAX.
Speaker 2: Two, right, IAX two stands for inter Asterisk Exchange Protocol
Speaker 2: Version two. It was designed by DIGITM mainly for connecting
Speaker 2: Asterisk servers.
Speaker 1: Together interasterisk, so it's mostly for Asterisk to Asterisk calls.
Speaker 2: That was the original idea, but its advantages make it
Speaker 2: useful in other situations too, especially overcoming those network issues
Speaker 2: as IP has.
Speaker 1: What are the advantages? How does it fix the firewall problem?
Speaker 2: The killer feature of IAX two is that it uses
Speaker 2: a single port usually EDP port four five sixty nine
Speaker 2: for everything. Both the call control signaling and the voice
Speaker 2: data travel over that one port.
Speaker 1: AH, so the firewall only needs to worry about one connection.
Speaker 2: Exactly much simpler. It means IAX two easily works in
Speaker 2: just about any environment without confusing firewalls or not enabled routers.
Speaker 2: Big win for network traversal. Plus, it uses smaller binary
Speaker 2: codes for signaling instead of sip's text based HGTP like commands.
Speaker 1: So uses less bandwidth two a bit less yeah.
Speaker 2: More efficient. So IX two is great for server links
Speaker 2: or situations where you control both ends and want simpler
Speaker 2: network setup. SIP is better for compatibility with the wider world.
Speaker 1: Makes sense. Choose the right tool for the job. What
Speaker 1: about connecting to actual old school phone lines, not VoIP
Speaker 1: For that, you use.
Speaker 2: Those interface cards we mentioned earlier, and they use a
Speaker 2: PoTA connections. That's just the internal Asterisk name for handling
Speaker 2: traditional phone hardware.
Speaker 1: Okay, zapata. And there are two types of signals.
Speaker 2: Right, FXO and FXS. You need an FXO port to
Speaker 2: connect to the phone company's line coming into your building.
Speaker 2: It expects to receive dial tone and signals from the network.
Speaker 1: Okay. FXO receives from the telco.
Speaker 2: And an FXS port is what you use to connect
Speaker 2: a standard analog telephone to your Asterisk server. It provides
Speaker 2: dial tone and signals to the phone, just like the
Speaker 2: phone company would.
Speaker 1: Got it. FXS sends to the phone. Okay, crucial feature
Speaker 1: for any PBX voicemail. How does Asterisk candle that? Is
Speaker 1: it some special hardware?
Speaker 2: Nope, that's the beauty of it. Asterisk just stores voicemails
Speaker 2: as regular audio files like WAV files or GSM files
Speaker 2: on the servers hard drive exactly, or a flashcard whatever
Speaker 2: storage you have. Compared to old pbx's with their expensive
Speaker 2: proprietary voicemail cards that held like an hour of messages, Yeah,
Speaker 2: Asterisk running on a PC affords you an amazing amount
Speaker 2: of storage space. Just add another hard drive if you
Speaker 2: need more. It's super flexible.
Speaker 1: And using it leaving messages checking them pretty standard.
Speaker 2: There are two main applications. Voice mail is used in
Speaker 2: the dial plant to like callers leave a message, and
Speaker 2: voicemail Maine is what you dial into to check your messages.
Speaker 2: It does all the usual stuff prompts, passwords, saving, deleting,
Speaker 2: plus cool things like sending you an email when you
Speaker 2: get a voicemail, I'm.
Speaker 1: Nice with the message attached yep, you can have.
Speaker 2: It attached to the audio file right to the email,
Speaker 2: or just send a notification. Really handy definitely.
Speaker 1: What other sort of standard PBX features does Asterisk handle easily?
Speaker 2: Well, there's music on hold obviously, you can even set
Speaker 2: up different classes of music, so callers to sales might
Speaker 2: hear one thing callers to support here.
Speaker 1: Another customizable hold music okay.
Speaker 2: And conference calls big one. For internal meetings, Asterisk uses
Speaker 2: an application called meet me lets multiple people dial into
Speaker 2: a virtual conference room.
Speaker 1: Meet me. Does that need anything special?
Speaker 2: It does? Yeah. It needs a reliable timing source to
Speaker 2: keep all the audio streams synchronized Usually this comes from
Speaker 2: one of those Digita hardware cards, or there's a software
Speaker 2: workaround using a kernel module called ZiT dummy if you
Speaker 2: don't have the hardware. But yeah, timing is key for
Speaker 2: clear conferencing.
Speaker 1: Okay, so this is all really powerful call handling. But
Speaker 1: you mentioned ASTROSK can be extended customized. That sounds like
Speaker 1: where the real power comes in, like that Samurai sword idea.
Speaker 1: How does that work?
Speaker 2: This is where it gets really interesting. The core mechanism
Speaker 2: for this is called AGI, the Asterisk Gateway Interface.
Speaker 1: AGI Gateway Interface sounds important.
Speaker 2: It is. It's how Asterisk can talk to external programs
Speaker 2: or scripts. Now, there's a simple way, using the system
Speaker 2: command and the dial plan. You can tell ASTs, hey,
Speaker 2: run this script.
Speaker 1: Okay, seems easy enough.
Speaker 2: It is. But the catch is once Asterisk runs that
Speaker 2: script using system, it kind of lets go. The source says,
Speaker 2: Asterisk can no longer interact with the script. It just runs,
Speaker 2: does its thing, and Asterisk moves on.
Speaker 1: So it's like a one way street. Asterisk tells the
Speaker 1: script to run, but can't get anything back from it
Speaker 1: during the call exactly.
Speaker 2: That's where AGI is different. AGI maintains a two way
Speaker 2: conversation between Asterisk and the external script while the call
Speaker 2: is active.
Speaker 1: Ah okay, that's the key. How does it manage that
Speaker 1: two way communication?
Speaker 2: It's actually the source calls. It a powerful yet simple system.
Speaker 2: It uses standard Unix file handles, std, std out, and cysdr.
Speaker 1: Started input stand output stand air like basic command line stuff.
Speaker 2: Pretty much. Asterisk sends commands and information to the script
Speaker 2: via the script's stdi in, and the script sends commands
Speaker 2: and results back to Asterisk via its stdout. It's a
Speaker 2: universal way for programs to talk.
Speaker 1: So because it uses these standard channels, it.
Speaker 2: Means almost any programming language can be used to write
Speaker 2: an AGI script. Perl, Php, Python, c Java, shell scripts,
Speaker 2: whatever can read from standard input and write to standard
Speaker 2: output can interact with Asterisk during a call.
Speaker 1: Wow, okay, that blows things wide open. Your phone system
Speaker 1: isn't just handling calls anymore. It's suddenly this interactive platform
Speaker 1: that can run code in response to calls.
Speaker 2: Exactly. It turns your phone system into like an application
Speaker 2: seer that happens to talk to people.
Speaker 1: Give us an example, soll what that's a cool, maybe
Speaker 1: unexpected thing you can do with Agi?
Speaker 2: Okay, here's a fun one from the source. Imagine you
Speaker 2: have one of those scrolling LED signs, like a Beta
Speaker 2: Brite sign. Yeah, you could write a pearl AGI script.
Speaker 2: The source gives one called wlsid dot pl that connects
Speaker 2: to that sign through the server serial port. When a
Speaker 2: call comes into Asterisk, don't tell me, the AGI script
Speaker 2: grabs the caller ID information and sends commands to the
Speaker 2: LED sign to display the caller's name and numbers scrolling
Speaker 2: across it lass.
Speaker 1: That's brilliant. A physical caller ID display on a big
Speaker 1: sign right.
Speaker 2: Just needs the Asterisk user to have permission to write
Speaker 2: to the serial port. But it's a perfect example of
Speaker 2: bridging the phone system to the physical world via a script.
Speaker 2: AGI scripts can also do things within the call, like
Speaker 2: say number to read digits back, say phonetic to spell
Speaker 2: things out, say time, even set calor rid to change
Speaker 2: the outgoing caller ID, or set contexts to move the
Speaker 2: call to a different part of the dial plant. Loads
Speaker 2: of control.
Speaker 1: That level of interaction is in credible. Is it hard
Speaker 1: to write these AGI scripts? Dealing with all of back
Speaker 1: and forth communication?
Speaker 2: We can be a bit fiddly, Yeah, handling all the
Speaker 2: commands and responses. But there are libraries to help, like
Speaker 2: Asterisk that AGI for Perol or PHPGI for PHP. These
Speaker 2: libraries handle a lot of the repetitive stuff, the boiler
Speaker 2: replate communication.
Speaker 1: Code, so the developer can just focus on the application launchic.
Speaker 2: Exactly once you focus more on developing the application itself.
Speaker 2: There are even more advanced versions too, like fast IGI
Speaker 2: FASTGI Yeah, that lets you run your AGI scripts on
Speaker 2: a completely separate server. They communicate with Asterisk over the network.
Speaker 2: Good for load balancing or if your scripts need special
Speaker 2: resources and there's dead AGI.
Speaker 1: Dead Agi sounds ominous tuckles net.
Speaker 2: It just means the AGI script can keep running even
Speaker 2: after the caller hangs up. Useful for cleanup tasks, logging
Speaker 2: stuff like that. And EAGI provides direct access to the
Speaker 2: call's audio stream for processing.
Speaker 1: Okay, the power and flexibility here are just immense, but
Speaker 1: that usually comes with the flip side right security, Let's
Speaker 1: pivot to that, the double edged sword. Maybe first, the
Speaker 1: protocols themselves. How does VoIP handle voice data and what
Speaker 1: are the vulnerabilities?
Speaker 2: Right? So, your actual voice when it's turned into data,
Speaker 2: it mainly travels using RTP, the real time protocol. We
Speaker 2: mentioned that briefly with SIP.
Speaker 1: Yeah, the second protocol SIP uses.
Speaker 2: Exactly, and RTP typically runs over UDP, the User Datagram protocol. Now,
Speaker 2: UDP is different from TCP, which most web traffic uses.
Speaker 2: UDP is stateless stateless meaning meaning it just sends packets
Speaker 2: out without checking if they arrived or in what order,
Speaker 2: like sending postcards instead of a registered letter.
Speaker 1: That sounds unreliable for voice. Wouldn't you lose words?
Speaker 2: You'd think so, but it's actually considered a feature for
Speaker 2: real time voice. TCP guarantees delivery right here, resends lost packets.
Speaker 2: Imagine doing that in a conversation. You get these long pauses,
Speaker 2: then a burst of delayed audio totally unusable.
Speaker 1: Ah. Okay, So UDP's unreliability is better for voice because
Speaker 1: it prioritizes speed over perfect delivery. A tiny blip is
Speaker 1: better than a long freeze.
Speaker 2: Precisely, the source notes that with TCP, minor network issues
Speaker 2: could render a VoIP conversation useless due to retransmissions. UDP
Speaker 2: just plows ahead, making it feel more immediate, even if
Speaker 2: a tiny packet gets lost here and there.
Speaker 1: Okay, So RTP over UDP for the voice itself, we
Speaker 1: talked about SAP versus IX two for signaling. Any security
Speaker 1: differences there.
Speaker 2: Well, SIPs text based AHCTP like commands make it easier
Speaker 2: to debug if something's wrong, you can just read the traffic,
Speaker 2: but they do use a bit more bandwidth. IX two's
Speaker 2: binary approach is more compact, efficient, and as we said,
Speaker 2: simpler for firewalls. From a pure security protocol view, both
Speaker 2: can be encrypted, but their structures differ. Now let's talk
Speaker 2: actual threats. What can go.
Speaker 1: Wrong right when voice is just data? What kind of
Speaker 1: attacks do you worry about?
Speaker 2: Well, the classics still apply denial of service DOS or
Speaker 2: distributed doss.
Speaker 1: D dogs flooding the network to take things offline.
Speaker 2: Yep, just overwhelming the asterisk server or the network connection
Speaker 2: with junk traffic so legitimate calls can't get it through.
Speaker 2: VOYIP is just as susceptible as any web server or
Speaker 2: email server, and because it's real time, it's often more
Speaker 2: sensitive to these floods. And importantly, the source points out
Speaker 2: neither integrity checks nor encryption can prevent these attacks. They're
Speaker 2: just about raw volume.
Speaker 1: So defense against DOS is more about network capacity and filtering,
Speaker 1: not the voyet protocol itself. What about attacks that try
Speaker 1: to like redirect calls that.
Speaker 2: Could be DNS poisoning or spoofing. If your VoIP system
Speaker 2: uses domain names like zip dotmcompany, dot com to find servers,
Speaker 2: an attacker could poison the DNS records.
Speaker 1: So when your phone tries to reach SIP dotmcompany, dot com,
Speaker 1: it gets sent to the attackers server instead.
Speaker 2: Exactly, they could intercept calls, record them, maybe try to
Speaker 2: steal credentials.
Speaker 1: Nasty. And what about attacks inside the local network man
Speaker 1: in the middle.
Speaker 2: Yeah, MITM attacks are a big risk, especially on switch networks,
Speaker 2: usually done via ARP spoofing.
Speaker 1: ARP spoofing refreshing my memory. That's tricking devices about MC addresses, right.
Speaker 2: An attacker sends out fake ARP messages basically telling your phone, hey,
Speaker 2: the server's MC address is my MC address, and telling
Speaker 2: the server, hey, the phone's MC address is my MAC address.
Speaker 1: So all the traffic between the phone and the server
Speaker 1: flows through the attacker's machine precisely.
Speaker 2: Tools like ettercap make this disturbingly easy. They can scan
Speaker 2: the network, find phones and servers, and perform the AARP
Speaker 2: poisoning automatically, even if your own computer isn't directly involved
Speaker 2: in the call. An attacker on the same network segment
Speaker 2: could potentially intercept it, and.
Speaker 1: Those villains we talked about help mitigate this.
Speaker 2: They help a lot. Yeah, if the phones are on
Speaker 2: a separate VLAN from most user machines, it makes it
Speaker 2: much harder for a casual attacker to even see the
Speaker 2: VOP traffic to begin with, let alone spoof.
Speaker 1: ARP for it. Okay, are there other VoIP specific attacks mentioned.
Speaker 2: Yeah, a few others. Rogue VoIP endpoint. Basically, an attacker
Speaker 2: finds an unused network jack, plugs in their own VoIP
Speaker 2: device and tries to register it on your system, maybe
Speaker 2: using stolen.
Speaker 1: Credentials sneaking onto the network.
Speaker 2: Right. Then there's registration hijacking. An attacker pretends to be
Speaker 2: your phone and tells the server, Hey, I'm extension one
Speaker 2: on one now rerouting your calls to them. Proxy impersonation
Speaker 2: tricks your phone into talking to a fake server, and
Speaker 2: the big one financially toll fraud.
Speaker 1: Toll fraud making expensive calls on someone else's.
Speaker 2: Dime exactly, hacking into the asterisk server itself, maybe through
Speaker 2: a week password or vulnerability, and then using it to
Speaker 2: make thousands of dollars worth of calls to international numbers
Speaker 2: or premium rate lines that can bankrupt a small company fast.
Speaker 1: Okay, lots of potential vulnerabilities. Now let's slip that Samurai
Speaker 1: sword again. How can Asterisk itself be used for security
Speaker 1: or maybe an auditing leveraging some of these network behaviors right.
Speaker 2: Using the tool offensively or at least proactively. One example
Speaker 2: given is combining Asterisk with motion detection software.
Speaker 1: Motion detection like security cameras.
Speaker 2: Yeah, there's open source software called Motion that watches video
Speaker 2: feeds from movement. You could configure Motion so that if
Speaker 2: it detects movement inside your house when you're away.
Speaker 1: It triggers an Asteris action exactly.
Speaker 2: It could run a script that tells Asterisk to call
Speaker 2: your cell phone, maybe even use AGI to play a
Speaker 2: specific warning message.
Speaker 1: Intruder alert playing on yourself.
Speaker 2: Could be and you could even try to spoof the
Speaker 2: caller ID to something like security camera nine nine zero
Speaker 2: zero zero zero one, though the source notes the name
Speaker 2: part security camera often gets dropped by the public phone network.
Speaker 2: They just look up the number. Still a cool integration.
Speaker 1: That is clever. Okay, what about something that sounds totally
Speaker 1: retro modems? Why on earth would you use a modem
Speaker 1: with foe IP.
Speaker 2: It sounds weird, right, but modems are still out there,
Speaker 2: coinasale terminals tvo boxes needing to call home some credit
Speaker 2: card equipment. They still use dial up and for security auditors.
Speaker 2: Modems are key for war dialing.
Speaker 1: Ah. War dialing. Now, that sounds familiar straight out of
Speaker 1: the movie Wargames, isn't it.
Speaker 2: The name got popularized by the movie in nineteen eighty four,
Speaker 2: But the actual practice, sometimes called demon dialing, is older.
Speaker 2: Is just systematically dialing phone numbers and arrange to see
Speaker 2: what answers, looking for modems, fax machines, maybe even other
Speaker 2: PBXs or voicemail.
Speaker 1: Systems, okay, scanning for open doors on the phone network.
Speaker 1: Why is doing this via VIP better than just using
Speaker 1: a regular phone line and a modem?
Speaker 2: Ah Several reasons. Big one annemity or at least obfuscation.
Speaker 2: With VoIP, you can often mask where I'm coming.
Speaker 1: From, spoofing the caller ID exactly.
Speaker 2: The source gives an example where prefixing a dial number
Speaker 2: with five tells their VoIP provider okay, spoof the caller
Speaker 2: ID to whatever I specify. This also messes up the
Speaker 2: A and I information that's automatic number identification the billing
Speaker 2: number basically, so it's harder.
Speaker 1: To trace back glover any other tricks.
Speaker 2: Yeah, here's a neat one. Spoof your telephone number as
Speaker 2: the number from an own fax machine.
Speaker 1: Why would you do that.
Speaker 2: To deter callbacks? If someone sees the mysted call and
Speaker 2: tries to call back, they just get a fax screeching tone.
Speaker 2: Less likely to investigate further loops.
Speaker 1: That's devs Okay, what was that other term? Backspoofing?
Speaker 2: Right, backspoofing, This is slightly different. You spoof a phone
Speaker 2: number to yourself, so you make a call from number
Speaker 2: X to number X. When the call hits, the phone
Speaker 2: company systems their caller ID named database CNAM looks up
Speaker 2: number X and displays the registered owner's name beck.
Speaker 1: You the caller, so you can use it to figure
Speaker 1: out who owns a particular number potentially.
Speaker 2: Yeah, right, uses the phone company's own database against itself
Speaker 2: in a way. And of course, Asterisk makes recording all
Speaker 2: these calls easy using the monitor command of the dial plan.
Speaker 2: But a big caveat here.
Speaker 1: Let me guess legalities.
Speaker 2: Absolutely the source stresses. Check your local laws regarding recording
Speaker 2: telephone calls. Consent requirements very hugely right, So is.
Speaker 1: There special software for doing this kind of OIP war dialing.
Speaker 2: There is an open source tool called i WAR Intelligent
Speaker 2: War Dealer i WAR.
Speaker 1: What makes it special It's.
Speaker 2: Designed for war dialing, so it supports things like random
Speaker 2: or sequential dialing, trying to detect modem tones, automatically blacklists
Speaker 2: of numbers not to call. But the key thing is
Speaker 2: it has native iax TOOIP support.
Speaker 1: Ah, so it can talk directly using that asterisk friendly
Speaker 1: protocol exactly.
Speaker 2: It acts as a full featured VoIP client designed specifically
Speaker 2: for dialing lots of numbers. The source shows an example
Speaker 2: command like i war pre dial five MP nine to
Speaker 2: four SAMUS five five five fifty range one than eleven hundred.
Speaker 1: So that would dial nine oh four five five five
Speaker 1: five thousand, one thousand and one, one thousand and two
Speaker 1: up to eleven hundred using that five poot prefix for.
Speaker 2: Spoofing precisely very targeted scanning.
Speaker 1: Okay, this is clearly powerful stuff, bordering on well packing
Speaker 1: tools depending on intent. What are the absolute must know
Speaker 1: legal points and security tips here?
Speaker 2: Number one repeated multiple times. Always always check your local
Speaker 2: and state laws before doing any kind of war dialing
Speaker 2: or security scanning, and critically get prior permission from the
Speaker 2: target on authorized scanning is illegal in most places. Don't
Speaker 2: do without explicit written permission.
Speaker 1: Permission is key, got it? And for securing your own
Speaker 1: Asterisk system against these kinds of things.
Speaker 2: Remember those config files, passwords in them are usually plain
Speaker 2: text oh right, not encrypted nope, So file permissions are critical.
Speaker 2: Make sure those config files are readable only by the
Speaker 2: user that Asterrisk is running under, usually a dedicated as
Speaker 2: Risk user. Don't let just anyone read them.
Speaker 1: Limit access. What else?
Speaker 2: If you have remote phones connecting you over the internet,
Speaker 2: home users, branch offices, use encryption SRTP for the voice stream.
Speaker 2: Maybe wrap everything in an IP six tunnel or use
Speaker 2: OpenVPN encrypt.
Speaker 1: That traffic, protect data and transit.
Speaker 2: Absolutely and back to the network level vlands, set them
Speaker 2: up properly, isolate your voice network. That's your best defense
Speaker 2: against eavesdropping and ARP spoofing on your local network.
Speaker 1: Wow. Okay, what an incredible journey through Asterisk. We've really
Speaker 1: gone from its sort of humble open source roots with
Speaker 1: Mark Spencer right.
Speaker 2: Just needing a cheaper PVX.
Speaker 1: All the way to this incredibly powerful flexible tool that
Speaker 1: Samurai sord analogy feels pretty accurate now. It can build
Speaker 1: amazing communications systems, but you also need to understand its
Speaker 1: power and potential dangers.
Speaker 2: It definitely requires careful handling knowledge. We've seen how you
Speaker 2: build it, configure it with those contexts and extensions, extend
Speaker 2: it with AGI connected with sep or iax.
Speaker 1: Two, and how to think about securing it from file
Speaker 1: permissions to vilans to encryption. It really empowers people and
Speaker 1: companies to control their own comms infrastructure in a way
Speaker 1: that just wasn't possible before. Unprecedented control really, So looking forward,
Speaker 1: as technology keeps racing ahead, you know, AI, Internet of Things,
Speaker 1: everything's getting connected, our reliance on these communication systems is
Speaker 1: only going to grow.
Speaker 2: Right, Absolutely, they're becoming even more critical infrastructure.
Speaker 1: So what new vulnerabilities might pop up as voyip gets
Speaker 1: tangled up with AI, with IoT devices, and maybe more optimistically,
Speaker 1: how will open source tools like asterisk keep evolving to
Speaker 1: let people innovate but also defend themselves in that that
Speaker 1: increasingly complex landscape.
Speaker 2: That's the big question, isn't it. Constant evolution and constant
Speaker 2: adaptation needed.
Speaker 1: Definitely something to chew on as you navigate your own
Speaker 1: digital world,