voiphopper

VoIP & PBXReady to RunLocation: /usr/local/bin/voiphopper

Command Line Execution

Run this command in the TelcoChisel terminal to launch or execute the tool:

voiphopper Command
voiphopper --help

Detailed Technical Overview

voiphopper is an automated security validation tool designed to mimic the behavior of an IP phone to bypass network segmentation. It passively sniffs or actively queries Cisco Discovery Protocol (CDP) and LLDP-MED packets to discover VoIP Voice VLAN IDs, then automatically builds an 802.1Q tagged sub-interface, requests an IP address via DHCP on the voice network, and hops from the data VLAN into the voice VLAN.

Configuration & Usage Guide

To initialize and configure voiphopper for telecom security audits, follow these steps:

  1. 1Listen for Cisco CDP broadcast and auto-hop to voice VLAN: sudo voiphopper -i eth0 -c
  2. 2Discover Voice VLAN via LLDP-MED: sudo voiphopper -i eth0 -l
  3. 3Manually build 802.1Q sub-interface for known Voice VLAN (e.g. VLAN 200): sudo voiphopper -i eth0 -v 200

Troubleshooting & Security Audits

voiphopper Audit Warning
Ensure you run voiphopper with sudo/root privileges, as creating 802.1Q sub-interfaces requires CAP_NET_ADMIN. Verify the physical switch port is configured as an 802.1Q trunk or multi-VLAN port.
CARRIER VOIP LAB

Master voiphopper with Interactive Telecom Labs

Practice deploying voiphopper against live cellular networks, radio interfaces, and mobile cores in TelcoSec Academy's browser-accessible cloud sandboxes.

Interactive Cloud Labs No Hardware Required CTSP Certification
Launch Interactive Labapp.telcosec.net · Instant access

Frequently Asked Questions

Why is voice VLAN hopping critical in telecom audits?

IP PBX systems and SIP trunking servers are often protected by network isolation inside a dedicated voice VLAN. Hopping into this VLAN gives attackers direct access to phone signaling and audio.

How do switches assign voice VLANs?

Switches broadcast CDP or LLDP-MED frames containing the Voice VLAN ID. When an IP phone boots, it tags its traffic with that VLAN ID.

Back to Tools Directory