Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 95 posts

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#81

Post by denkmoon »

unethical_ban wrote: post #73
kkielhofner wrote: post #61

Earlier quoted context omitted.

I’d argue that a reasonable network limitation with a minimal blast ratio is responsible. For example, I use SIP over 5060 on Spectrum without issue. Not having their network used by bots to inflict untold financial damage is being responsible. Would you argue that implementation of BCP38 to cut down on bots used in DDoS attacks is “not the ISP’s responsibility”? Plus, they get the abuse reports from the victims and…

Nah, just like port 25 outbound being blocked is shitty. How can we have a decentralized net when consumer ISPs make people call in or beg to have full network access? Yes, do some flood detection, but the problem is that the SIP provider should be, as another commenter put, block international calls or otherwise detect/reject calls to toll systems. Who the heck uses toll numbers anymore anyway?

You buy access on a network that doesn't block those things, if you want a network that doesn't block those things.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#82

Post by fragmede »

devwastaken wrote: post #59
kkielhofner wrote: post #20

Earlier quoted context omitted.

Glad this is at the top. The linked Reddit thread demonstrates a common but fundamental misunderstanding of SIP. Port 5060 is used for call control and is very low traffic. At most you may have timed OPTIONS messages but a “standard” SIP deployment is at most a handful of (small) packets per second per call setup and tear down with occasional REGISTER messages on an interval measured in seconds. Very low traffic and…

Not the ISP's responsibility.

Yes it is. A responsible consumer ISP that's a good citizen on the Internet takes responsibility for everything that comes out of their system which includes, in practice, blocking ports for customers unless the customer calls tech support to get it unblocked. It also includes blocking outgoing DDoS traffic and kicking customers offline until they resolve the issue. And blocking spam sending bots. Unless you think keeping infected Windows PCs and rooted webcams online is a good thing.

Of course, not all ISPs do this, which is why DDoS attacks are still a thing, but the point remains, that responsible ISPs will take steps to prevent malicious traffic on the Internet from exiting their systems.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#83

Post by another_comment »

kkielhofner wrote: post #61
devwastaken wrote: post #59

Earlier quoted context omitted.

Not the ISP's responsibility.

I’d argue that a reasonable network limitation with a minimal blast ratio is responsible. For example, I use SIP over 5060 on Spectrum without issue. Not having their network used by bots to inflict untold financial damage is being responsible. Would you argue that implementation of BCP38 to cut down on bots used in DDoS attacks is “not the ISP’s responsibility”? Plus, they get the abuse reports from the victims and…

>>I’d argue that a reasonable network limitation with a minimal blast ratio is responsible.

I'm the OP and I agree. Across 3 Twilio phone numbers and I maybe make 4 voice calls and 10 texts a week. I've been doing this for 4 years or more.

>> For example, I use SIP over 5060 on Spectrum without issue.

As did I, until a week or so ago. Until I was cut off, without notice. I've been a Spectrum residential customer since the 1990s.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#85

Post by iatt »

notatoad wrote: post #72
devwastaken wrote: post #59

Earlier quoted context omitted.

Not the ISP's responsibility.

no, the ISP's responsibility is to ensure that the majority of their customers can access websites over http/s. and if their IP blocks are getting added to "likely scammer" lists because of SIP scams originating on their network, then it's in their best interest to do something do discourage those scams. the people working to defeat scammers aren't necessarily making distinctions between port numbers.

The Internet (The I in ISP...) is far more than than the web. Mere HTTP/s access is suffocating, and we should not normalize this as a customer expectation.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#86

Post by jacob019 »

megous wrote: post #24
_wldu wrote: post #15

They are probably trying to reduce SIP abuse. It's a big problem.

Yeah, running SIP on a standard port without some serious firewall based rate limiting for unknown traffic is almost impossible. I tried running a PBX on UDP 5060 and got >4GiB of logged register attempts in a few hours after opening the port, while asterisk was running at 100% CPU just rejecting the registration attempts the whole time. It's insane compared to any other public service I run.

I wrote a script that monitors the asterisk log and uses iptables to block any IP with a failed request. Problem solved. Sometimes I check how many IPs are blocked, it's astonishing.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#87

Post by Brian_K_White »

chihuahua wrote: post #67
bombcar wrote: post #55

Earlier quoted context omitted.

You can do something similar in the US - many condos have it setup where they technically are an ISP and pay for transit. Usually it's not worth it because you end up doing end-user support for every neighbor and people are dumb as rocks. But you'd be surprised how cheap a "very fast" transit internet connection can be.

I agree with what you're saying about support. I get nauseous just thinking about the number of people who call their ISP just because their laptop has a flaky Wifi module, and the thought of having to deal with that.

fact

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#88

Post by tinus_hn »

kkielhofner wrote: post #20
_wldu wrote: post #15

They are probably trying to reduce SIP abuse. It's a big problem.

Glad this is at the top. The linked Reddit thread demonstrates a common but fundamental misunderstanding of SIP. Port 5060 is used for call control and is very low traffic. At most you may have timed OPTIONS messages but a “standard” SIP deployment is at most a handful of (small) packets per second per call setup and tear down with occasional REGISTER messages on an interval measured in seconds. Very low traffic and…

The real abuse of course is $5 a minute toll line. The ability to rack up that kind of charge should be opt-in, there’s basically no legitimate use case.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#89

Post by thomashabets2 »

ShroudedNight wrote: post #58
thomashabets2 wrote: post #50

My ISP breaks traceroute outside of the network. Their transit is cut out of my traceroutes. Full technical story at https://blog.habets.se/2022/05/Another-way-MPLS-breaks-trace...

Huh, I remember back in the day seeing weird latency cliffs like that when trying to troubleshoot latency issues when playing World of Warcraft. There always seemed to be one between basically any ISP I was connected to and the AT&T network blizzard was running their servers on.

The weird part is not any latency numbers (TTL exceeded is not handled by a router's fast path), but hops missing.

Hops marked with "* * *" do not count as "missing" here.

Re: Tell HN: Spectrum is blocking TCP/UDP 5060 at my home

#90

Post by thomashabets2 »

mike_d wrote: post #74
thomashabets2 wrote: post #50

My ISP breaks traceroute outside of the network. Their transit is cut out of my traceroutes. Full technical story at https://blog.habets.se/2022/05/Another-way-MPLS-breaks-trace...

It looks like someone technical from your ISP also replied in the comments of your post and offered to set up a call to explain it to you. That is far better than you can expect from almost any other provider.

Yeah, long story short I had a call with him, and he agreed that's probably right but it's not a priority to fix.

I hope they'll fix it soon, but not if it delays IPv6.

If I had a choice of FTTP providers then IPv6 support would weigh really high on my choice, but only one has dug up the street.

Post reply on HN