SIPp is a free test tool and traffic generator for the SIP protocol. It uses XML format files to define test scenarios.
General usage: sipp remote_host[:remote_port] [options]
Some important command-line options:
- -sf filename
- Load test scenario from specified file.
- -inf filename
- Use CSV file to insert data substituted for [field0], [field1], etc into XML scenario. First line of file describes order of inserting field sets (SEQUENTIAL/RANDOM/USE).
- -sn name
- Use one of the embedded, predefined scenarios like "uac", "uas".
- -r rate
- Scenario execution rate, default value = 10 times per period, default period = 1000 ms.
- -rp period
- Scenario execution period [ms], combined with execution rate. Execution rate is combined of rate and period parameters, i.e. if period = 3500 and rate = 7 there will be 7 calls in 3.5 s.
- -t transport mode
- Set the transport mode: "u1" - UDP, one socket (default), "un" - UDP, one socket per call, other modes (TCP and with compression) available.
- -max_socket max
- Set the limit for simultaneously used sockets (for one socket per call mode). If limit is reached, sockets are reused.
- -m calls
- Stop and exit after specified tests count.
- -s service
- Set user part of the request URI (default: 'service'). Replaces [service] tag in XML scenario file.
- -ap pass
- Set password used for auth challenges (default: 'password').
- -l limit
- Limit simultaneous calls (default: 3 * call_duration (s) * rate).
- Global receive timeout (miliseconds). By default call is aborted, use ontimeout attribute to take other action.
- Log sent and received SIP messages (file: scenario_pid_messages.log).
- Log error message to file (like "Discarding message which can't be mapped to a known SIPp call").
- Dumps one of the default scenarios. Usage example: sipp -sd uas > uas.xml.
Simple scenario files with usage
These scenario files were tested with sipp-win32-2009-06-06.
Send OPTIONS message 5 times to firstname.lastname@example.org.
sipp 192.168.1.211 -sf OPTIONS.xml -m 5 -s 30
Send OPTIONS message 30 times to email@example.com waiting 200 ms for 200/OK reply each time.
sipp 192.168.1.211 -sf OPTIONS_recv_200.xml -m 30 -s 30
Register to 192.168.1.106 using parameters from CSV file. If CSV file has more than one entry you can increase simultaneous call limit (-l option).
sipp 192.168.1.106 -sf REGISTER_client.xml -inf REGISTER_client.csv -m 1 -l 1 -trace_msg -trace_err
REGISTER + SUBSCRIBE application/dialog-info+xml (BLF)
Register to 192.168.1.211 using parameters from CSV file and start dialog-info subscription (RFC4235).
sipp 192.168.1.211 -sf REGISTER_SUBSCRIBE_client.xml -inf REGISTER_SUBSCRIBE_client.csv -m 100 -l 2 -r 2
REGISTER + INVITE
SIPp is simulating 3 UACs, each one of them is making outgoing call. This scenario expects calls to be answered. Call targets are 3 other UACs configured to auto answer and play wav file (single pjsua instance with 3 accounts).
pjsua_vc6d --local-port=5068 --id sip:firstname.lastname@example.org --registrar sip:192.168.1.211 --proxy sip:192.168.1.211 --realm * --username 33 --password 33 --next-account --id sip:email@example.com --registrar sip:192.168.1.211 --proxy sip:192.168.1.211 --realm * --username 34 --password 34 --next-account --id sip:firstname.lastname@example.org --registrar sip:192.168.1.211 --proxy sip:192.168.1.211 --realm * --username 35 --password 35 --play-file file.wav --auto-answer 200 --auto-play
Each call is disconnected after 30 s. Call limit is this time smaller than number of CSV entries to avoid multiple calls to single target.
sipp 192.168.1.211 -sf REGISTER_INVITE_client.xml -inf REGISTER_INVITE_client.csv -m 100 -l 2 -r 1 -rp 10000
REGISTER + INVITE (2)
Some modification may be needed when calling operator that is using more complex
1) Handling SIP/407 after INVITE.
2) Using rrs="true" and [routes] to keep Record-Route header set supplied by the operator.
3) Using [next_url] in ACK and BYE messages.
sipp 192.168.1.211 -sf REGISTER_INVITE_client2.xml -inf REGISTER_INVITE_client.csv -recv_timeout 10000 -m 1 -l 1
INVITE + CANCEL immediately after SIP/100
sipp 192.168.1.211 -sf INVITE_CANCEL.xml -recv_timeout 10000 -m 1 -l 1
INVITE with video stream SDP (H.263, H.264, AS/TIAS bandwidth modifiers)
sipp 192.168.1.211 -sf INVITE_SDP_video.xml -recv_timeout 30000 -m 1 -l 1
INVITE + re-INVITE with T38 offer
When detecting FAX tone 1st party sends re-INVITE with T38/image offer. Second party rejects offer with 488/Not Acceptable Here but call should not be disconnected.
sipp 192.168.0.192 -sf INVITE_T38_reINVITE.xml -s 30 -r 1 -l 12 -m 1
REGISTER UAS + SUBSCRIBE application/dialog-info+xml (BLF) UAS
Little tricky scenario that requires two actual scenario files.
Sipp is simulating registration and BLF subscription server that immediately terminates
subscription with reason=noresource.
1) With tested UAC create registration account 30@your_pc_ip_address, no password. Create dialog-info+xml subscription for 108@your_pc_ip_address.
2) Run UAS REGISTER scenario and wait for the phone to log in. 3) Break REGISTER scenario by hitting Ctrl+C and run UAS SUBSCRIBE scenario.
sipp -sf uas_register.xml sipp -sf uas_subscribe.xml
REGISTER UAS sending unsolicited MWI NOTIFY messages
Sending unsolicited message-summary events to registered phone (email@example.com)
sipp 192.168.0.228 -s 31 -sf NOTIFY_MWI_unsolicited.xml -m 1 -l 1 -r 1 -rp 1000
Unsolicited NOTIFY with Event: talk
Sending unsolicited talk event (if supported: causing call to be answered) to phone (firstname.lastname@example.org)
sipp 192.168.0.228 -s 31 -sf NOTIFY_talk_unsolicited.xml -m 1 -l 1 -r 1 -rp 1000
Session audit using UPDATE message
DUT is expected to send 200/OK with SDP offer but not changing session parameters.
sipp 192.168.0.228 -sf INVITE_UPDATE_session_audit.xml -m 1 -l 1
REGISTER UAC + INVITE + DTMF INFO
1) SIP registration with authorization.
2) Calling number 110. In my test extension 110 is FXS and is looped back to FXO port and call is answered by DISA.
3) Dialing another 3-digit number using SIP INFO DTMF (Content-Type: application/dtmf-relay in this scenario). Call is not answered.
Note: if using "application/dtmf" Content-Type (message body consisting of dtmf only) sign "*" should be encoded as "10" and "#" as "11".
sipp 192.168.1.211 -sf REGC_INVITE_INFO.xml -inf REGC_INVITE_INFO.csv -m 5 -l 1 -r 1 -rp 10000
SIP digest leak test
SIP digest leak is a SIP phone vulnerability that allows attacker to get digest response from a phone and use it to guess password using brute-force method described first on enablesecurity.com page. Here are required steps:
- attacker calls phone (direct IP call) sending INVITE frame,
- callee picks up phone, connection is confirmed by both sites,
- attacker does not send any RTP frames (at least does not have to) and just waits,
- callee hangs up phone sending BYE request (probably throwing some profanities),
- in response to BYE attacker sends SIP/401 or 407 message (authentification request),
- if attack is successfull callee is sending BYE again with Authorization: Digest header added.
At this point attacker has authentification challenge (sent by him with 401/407 message) and response (received with last BYE). Most likely there will be simplest SIP/2.0 authentification scheme used (RFC2069):
ha1 = MD5(username ":" realm ":" password) ha2 = MD5(method ":" req_uri) response = MD5(ha1 ":" nonce ":" ha2)
Assuming that username and realm are known attacker can now use brute-force method to guess user password.
There are few conditions that have to be met to make this scheme work:
- SIP phone has to respond to authentication challenges sent by other sources than registration server(s) it is using (as a note it works with one hardware phone and one softphone I've tested (and those were all user agents I've tested)),
- phone SIP port has to accessible to attacker, usally phone will be placed behind the Restricted Cone NAT and port would not be forwarded,
- attacker would most likely have to know username and authentication realm used by target; for better security you probably should not leave "realm" configuration field of SIP phone empty (it could respond to challenges with any realm then making it easier to prepare attack),
- guessing password through brute-fource would be time consuming or almost impossible for more complex passwords.
sipp 192.168.1.211 -sf uac_digest_leak.xml -s 30 -m 1
Example result: digest_leak.log.
Generating calls using G.729 codec
If you ever had to make high-load call or even single-call tests with G.729(a) codec then you may find out that finding a free softphone with G729a capability is not an easy task. Obviously pjsua would be good choice, but it require downloading DirectX SDK, Intel Performance Primitives package and rebuilding from sources, so it would take few hours to get working binary.
Another option is capturing RTP stream using Wireshark and playing it back when generating or receiving calls with SIPp. Here is .pcap file with 2 minutes of G.729 RTP stream. This is actually recorded connection with some voice mail system. Extract this file to \pcap subdirectory of SIPp. Included scenario is UAC call, to get credible load test results you can call i.e. some DISA or auto-attendant lines that will play some announcement back.
sipp 192.168.1.211 -sf uac_pcap_G729.xml -l 1 -m 10
Call with video payload from captured RTP (H.264)
sipp 127.0.0.1 -sf uac_pcap_H264.xml -l 1 -m 1
Registration with authorization, call and blind transfer
REGISTER ----------> 100 <---------- (optional) 401 <---------- REGISTER ----------> 100 <---------- (optional) 200 <---------- INVITE ----------> 100 <---------- (optional) 180 <---------- (optional) 183 <---------- (optional) 200 <---------- ACK ----------> Pause [ 5000ms] REFER ----------> 200 <---------- NOTIFY <---------- 200 ----------> NOTIFY <---------- 200 ----------> Pause [ 1000ms] BYE ----------> 200 <----------
sipp 192.168.1.211 -sf REGISTER_INVITE_REFER.xml -inf REGISTER_INVITE_REFER.csv -m 1 -l 1 -r 1 -rp 10000
UAS with T38 reinvite
Simulating UAS that sends re-INVITE with image/t38 after detecting fax tone / preamble
on fax reception.
Since there is no actual tone/preamble detection script assumes that all calls are fax calls
and reinvites all calls after short delay.
Note: actual fax transmission would fail after timeout due to no UDPTL endpoint presence.
Contains From/To headers content swapping using variables and ereg action.
sipp -sf uas_T38_reinvite.xml
For similar tests: rtp_pcma_fax_cng.pcap - CNG signal recorded from PCMA RTP stream (can be used with scenario similar to uac_pcap_G729.xml to test switching to fax extension on CNG detection).
Short announcement, CED signal and modem preable/training sequence as generated by software bundled with PC fax/modem I bought: rtp_pcma_fax_ced_training.pcap.
Running two or more scripts same time
Simulating two endpoints with single script seems difficult if not impossible, so some tests requre running two or more separate scripts (e.g. one for caller: REGISTER + outgoing INVITE, second for callee) same time. To synchronization between scripts create batch file:
start cmd /K sipp [parameters1] start cmd /K sipp [parameters2] [Enter]
With /K switch new cmd window will stay open after sipp exit. /C switch closes cmd window on application exit. If delay between scripts is needed (alternatively pause can be used inside scripts), e.g. callee must register before caller executes use ping as follows:
start cmd /K sipp [parameters1] ping -n 3 127.0.0.1 > nul // pauses for 3 - 1 = 2 seconds total start cmd /K sipp [parameters2] [Enter]
Pjsua as a scripted call generator
Pjsua sleep command allows to pipe commands from prepared text file to pjsua in a timely manner making it possible to use it as limited but very easy to use call generator.
pjsua < commands.txt
Tools to generate scenario files from Wireshark traces
For simple tasks such as sending single SIP message to remote destination sipsak may be handy.
Sending OPTION message:
sipsak -vv -s sip:192.168.1.10:5060
Sending custom message (NOTIFY Event: check-sync;reboot=true causing yealink phone to reboot):
sipsak -f reboot_yealink.sipfile -s sip:email@example.com
Win32 SIPp build with drag-and-drop launcher.