[VoIP] Nortel/Ambit ATA

[Steph Kerman]

Keelan,

Thanks.

I took photos of the board.  I'll inspect them and if they are nice and 
clear I will put them where you can fetch them.  Otherwise I will dig it 
back out and answer the specific question.

Steph

Keelan Lightfoot wrote:
> Steph,
>
> The Ambit ATA has a 5 pin header with ground, TXD, 3.3V, RXD and  
> ground again. You can see it here:
>
> http://pixalis.com/keelan/ambitata.html
>
> What controller does the RTP300 use? The Ambit utilizes a Broadcom  
> BCM1112; I'm curious if the RTP300 uses something similar.
>
> - Keelan
>
> On Dec 11, 2006, at 7:12 PM, Steph Kerman wrote:
>
>   
>> Hi Keelan,
>>
>> I just inspected inside a Linksys RTP300.  It has an unmarked row of 5
>> pins on 0.1" centers and an umnarked and unpopulated 2x7" header
>> location.  Both have a few pins with +3.3V on them and ample number of
>> obvious grounds.  I'm going to inspect the pins with a scope during
>> power up to see whether any of them wiggle in any rhythmic way.  If  
>> they
>> do I'll find an RS232 driver chip.
>>
>> Was there just the basic RXD, TXD and ground on the Ambit/Nortel or  
>> were
>> there flow control lines too?
>>
>> Steph
>>
>> Keelan Lightfoot wrote:
>>     
>>> I thought I'd take a minute to share some information on what seems
>>> to be a unknown brand of ATA.
>>>
>>> I happened across a couple Nortel single port ATAs (re-badged Ambit
>>> ATAs) a while back. Like Vonage ATAs, they were locked up. The only
>>> access I had was to a useless client-side interface where I could
>>> change their network port settings. I popped the case open, and there
>>> was a well-labeled serial port header on the board. With a RS-232-
>>>       
>>>> 3.3v level convertor I was able to access the serial console
>>>>         
>>> interface, but it unfortunately was also limited without the correct
>>> password.
>>>
>>> The good news is that if I rebooted it and hit ctrl-c during the boot
>>> sequence, it would dump to a very simple boot monitor (commands:
>>> help, exit, boot, memdump). I searched the resulting dump for the
>>> password for the area that I had access to. About 2 lines of garbage
>>> above my password was the supervisor password that gave me access to
>>> the entire system.
>>>
>>> The interesting thing is that my two ATAs both had the same 6
>>> character password -- It makes me think twice about the security of
>>> some VOIP providers.
>>>
>>> Anyway, if you have access to one of these things, finding the
>>> password is not too difficult given time and the motivation to do it.
>>> They support pulse dialing, and have a fairly competent web based
>>> management interface, and they play well with Asterisk.
>>>
>>> - Keelan
>>>
>>>
>>>
>>>       
>> _______________________________________________
>> VoIP mailing list
>> VoIP at ckts.info
>> http://lists.ckts.info/mailman/listinfo/voip
>> Project Web Page: http://www.ckts.info/
>>
>>     
>
>
> _______________________________________________
> VoIP mailing list
> VoIP at ckts.info
> http://lists.ckts.info/mailman/listinfo/voip
> Project Web Page: http://www.ckts.info/
>
>
>