Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

[another_comment]

For several years, I've run 3 VOIP phones from my house. About a week ago they stopped working. SIP REGISTER started failing.

Turns out Spectrum now blocks TCP/UDP port 5060. My workaround is to use a VPN. After that, everything is fine.

This reddit thread https://www.reddit.com/r/networking/comments/t8nulq/spectrum_is_rate_limiting_voipsip_traffic_port/ suggests Spectrum was rate limiting 5060 on 300mbps plans, but not on the 100mbps plans.

I have the 100mbps plan, and it is definitely affected now.

So if you are in SoCal, using Spectrum, and your VOIP phones suddenly stopped working in the last week or so, maybe this will help you.

[_wldu]

They are probably trying to reduce SIP abuse. It's a big problem.

[kkielhofner]

Glad this is at the top. The linked Reddit thread demonstrates a common but fundamental misunderstanding of SIP.

Port 5060 is used for call control and is very low traffic. At most you may have timed OPTIONS messages but a “standard” SIP deployment is at most a handful of (small) packets per second per call setup and tear down with occasional REGISTER messages on an interval measured in seconds. Very low traffic and very low bandwidth. Obviously with more devices you get multiples of these numbers but still very low. 15 kbps is a pretty significant amount of SIP traffic.

This is most likely targeting VoIP abuse from tools like sipvicious. In a nutshell they scan the internet looking for open SIP ports. They then try to brute force credentials to place calls.

Why? Toll fraud. The scam works like this:

1) Setup an international toll charge number in some country. Let’s say it charges $5/min. For those that don’t know calls to these numbers get charged to the person placing the call from their phone company and end up on their phone bill with the amount getting paid out (less a cut) to the operator of the number.

2) Compromise a bunch of random exposed SIP implementations on the internet.

3) Place calls to your (or a partners) toll number.

4) Get paid from the toll charges.

5) Some time later the owner of the compromised system gets a huge bill depending on fraud detection systems at the carrier, how fast you could pump calls, etc.

It’s gotten so bad many VoIP providers block international calls by default and now (apparently) might be blocking 5060 traffic in some way.

This isn’t that different to what’s happened with SMTP over the years. To combat spam many last mile ISPs started blocking outbound TCP port 25 so compromised machines couldn’t directly send spam. This is where port 465/587 for SMTP “submission” came from.

[nousermane]

Ah, yes. The classic "all our customers are morons" approach, with no opt-out for those 0.1% who, in fact, are not. Very typical among ISPs/Telcos.

Where I am, we used to have a different, "nerdy" ISP [0], where customer was allowed to bring their own modem; they also provided real IPv4/v6 dual-stack since forever, easy to request a /29, tech-support that's realistic to reach, and staffed with people who know what they are talking about, no bulk-firewalling port-25, etc... All for a modest 2x price increase over market average. Alas, they're out of business now.

[0] https://en.wikipedia.org/wiki/Xs4all

[megous]

Yeah, running SIP on a standard port without some serious firewall based rate limiting for unknown traffic is almost impossible.

I tried running a PBX on UDP 5060 and got >4GiB of logged register attempts in a few hours after opening the port, while asterisk was running at 100% CPU just rejecting the registration attempts the whole time.

It's insane compared to any other public service I run.

[josephcsible]

That doesn't make what they're doing okay. To see why, imagine that they instead blocked access to all email services except their own, since spam is a big problem.

[im3w1l]

It doesn't fit. The reddit thread describes inbound traffic being rate limited. But SIP abuse would be outbound traffic.

[3np]

You mean mass spam calling? Or what kind of abuse?

[TheSwordsman]

At least where I am in SoCal, AT&T literally just deployed fiber with plans up to 5 gigabit/s. I'm so glad to be leaving Spectrum behind, because when moving here I never thought I'd have a cable Internet provider that made me miss Comcast...

So hopefully you have some other options soon. :)

[throwaway413]

Saw your comment, went to my ATT internet account, and just upgraded from 1k to 5k! I’m so happy, thanks!

[throwaway413]

So, interesting stuff! I had my installation appointment, the guy came out and proceeded to tell me that the 5k plan would be useless to me. I asked why - apparently switches have not progressed at the same speed. Latest MBPs for example only support up to ~1300Mbps via wifi (however could support up to 10Gb bandwidth via Ethernet.) Most of my devices I use via wifi anyways. I have 1 Pi plugged in. I guess most hardware only has a 1k switch in it these days?

With that new info, I decided to stick to my 1k plan until more hardware catches up.

[jeroenhd]

Is that even legal? Blocking network traffic because it competes with their offering?

[yummypaint]

From the wikipedia net neutrality page it looks like the FCC's stance has historically depended on the administration in power. There was the much celebrated 2015 change to title II, which was undone in 2017 i.e. the start of the ajit pai era. Now he is finally gone, but not before casting his vote in a 3-2 decision in 2020 to keep net neutrality dismantled. The new chair is pro-nn and working to undo the damage but it takes time.

[zbrozek]

Carriers do all kinds of filtering. They've blocked mail, file transfer, network discovery, and others for a long time. cgNAT blocks half of everything.

[throw0101c]

The terms of service may prohibit running a "service" or "server", for some definition, on a residential contract.

[jmole]

Maybe they're forwarding the port to an internal service running on the router, instead of blocking it. At the very least, it would be nice if they let you turn it off.

[thomashabets2]

My ISP breaks traceroute outside of the network. Their transit is cut out of my traceroutes.

Full technical story at https://blog.habets.se/2022/05/Another-way-MPLS-breaks-trace...

[ShroudedNight]

Huh, I remember back in the day seeing weird latency cliffs like that when trying to troubleshoot latency issues when playing World of Warcraft. There always seemed to be one between basically any ISP I was connected to and the AT&T network blizzard was running their servers on.

[mike_d]

It looks like someone technical from your ISP also replied in the comments of your post and offered to set up a call to explain it to you. That is far better than you can expect from almost any other provider.

[matt123456789]

Guess they want you to pay for their bundled phone plan instead. I’m guessing you can bring this to their attention and get some boilerplate response containing words like “abuse” and “safety”. Prognosis: This will go to court on common carrier terms and the block will be lifted in 3-4 years.

[another_comment]

>> Guess they want you to pay for their bundled phone plan instead.

I think you are right. But I am waaaay to cheap for that. I'm using Twilio on some Raspberry Pi's with some software I wrote myself. For 3 phone numbers, I'm spending like $10 a month total.

[another_comment]

My call quality also seems better since I've switched on the VPN. I do not have numerical proof of this, but it sure seems like my voice calls are crystal clear now.

[another_comment]

My guess is Spectrum has been rate limiting port 5060 for a while, and finally just turned it off.

Nice.

[Prolixium]

FWIW, when I lived in Seattle I found that Lumen's DSL service blocked it as well. It wasn't an obvious block, though. It was either some DPI or size-based filtering. I wrote it up here for posterity:

https://blog.prolixium.com/2021/01/23/does-centurylink-dsl-b...

It worked just fine through Comcast's Xfinity service (although at the time, that service had other critical issues for me..) and I have no problem now with Verizon Fios.

[achillean]

It looks like port 5060 is becoming less common on their networks:

https://trends.shodan.io/search?query=port%3A5060+org%3Achar...

[more_corn]

Fuck spectrum. They’re the worst. Drop them for a better carrier.

A critical service is nonfunctional. You should not have to VPN for your internet service to work. I can’t believe I even have to say that.

[relentlesshack]

Use a session border controller if possible to get around the port blocking.

[StayTrue]

Can you use port 5061?

[another_comment]

Excellent question. I will try that tomorrow morning and report back.

[gsich]

5061/tcp is preferrable. It also works with TLS.

[Kikawala]

Are they also blocking 5061 SIP-TLS?

[animitronix]

Sue them into the ground

[dylan604]

They'll just change names again, so your suit will be for a new dead company