rtpbleed

VoIP & PBXReady to RunLocation: /usr/local/bin/rtpbleed

Command Line Execution

Run this command in the TelcoChisel terminal to launch or execute the tool:

rtpbleed Command

rtpbleed --help

Detailed Technical Overview

rtpbleed is a targeted scanner and audio extraction engine for RTP Bleed vulnerabilities (CVE-2017-9936 and related proxy port bleeding flaws). In vulnerable media proxies (like older versions of RTPproxy, RTPEngine, or Kamailio/OpenSIPS media relays), an unauthenticated attacker sending 1-byte UDP probes to allocated RTP ports causes the proxy to latch onto the attacker's IP and redirect live call audio to the attacker.

Configuration & Usage Guide

To initialize and configure rtpbleed for telecom security audits, follow these steps:

1Scan a media proxy port range for open, bleeding RTP sessions: rtpbleed -t 192.168.1.50 -p 10000-20000
2Capture and dump bleeding RTP audio payloads to disk: rtpbleed -t 192.168.1.50 -p 12344 --dump-audio /tmp/session.raw
3Run fast non-intrusive port audit: rtpbleed -t 192.168.1.50 --probe-only

Troubleshooting & Security Audits

rtpbleed Audit Warning

High-latency WAN connections can cause false negatives. Set a higher socket timeout (-w 500) if scanning across public Internet links.

CARRIER VOIP LAB

Master rtpbleed with Interactive Telecom Labs

Practice deploying rtpbleed against live cellular networks, radio interfaces, and mobile cores in TelcoSec Academy's browser-accessible cloud sandboxes.

Interactive Cloud Labs No Hardware Required CTSP Certification

Launch Interactive Labapp.telcosec.net · Instant access

Frequently Asked Questions

What is RTP Bleed?

It is an architectural vulnerability where media proxies that implement symmetric RTP without source address validation latch onto the first packet received on a media port, redirecting the real call's audio stream to the attacker.

How can I play back raw audio dumped by rtpbleed?

Import the raw capture into Audacity as 8000 Hz, 1-channel 8-bit (G.711 u-law / A-law) PCM.