Sniffing & Spoofingrtpfuzzersipmitmarpspoofphone

ohrwurm

ohrwurm is a small RTP fuzzer tested on SIP phones. It fuzzes RTP traffic between two hosts using MITM techniques.

Description

ohrwurm is designed to fuzz RTP traffic, particularly targeting SIP phones in a switched LAN environment. It requires arpspoof from dsniff for the man-in-the-middle attack to intercept and manipulate RTP streams between two target IP addresses. The tool reads SIP messages to extract RTP port numbers or allows manual specification of ports to fuzz any RTP traffic.

Use cases include testing the robustness of SIP phones against malformed RTP packets. Special care is taken to disrupt RTP handling, with configurable bit error ratios applied to payloads. RTCP traffic suppression is available to prevent codecs from detecting noisy lines. Gateway operation works only partially, making it best suited for switched LAN scenarios.

Dependencies include dsniff, libc6, libpcap0.8t64, and ohrwurm itself.

How It Works

ohrwurm performs MITM using arpspoof to position itself between two SIP phones. It sniffs SIP messages for RTP port discovery unless ports are manually provided with -A and -B, skipping SIP sniffing. RTP payloads are fuzzed with a configurable constant bit error ratio (BER), while special techniques target RTP handling vulnerabilities. RTCP packets can be suppressed via -t to avoid codec noise detection. Random seed controls fuzzing variability, defaulting from /dev/urandom.

Installation

bash
sudo apt install ohrwurm

Flags

-a <IP>IPv4 address A in dot-decimal notation of SIP phone A
-b <IP>IPv4 address B in dot-decimal notation of SIP phone B
-s <integer>randomseed (default: read from /dev/urandom)
-e <double>bit error ratio in % (default: 1.230000)
-i <interfacename>network interface (default: eth0)
-tsuppress RTCP packets (default: dont suppress)
-A <port>RTP port on IP a (requires -B); skips SIP sniffing
-B <port>RTP port on IP b (requires -A); skips SIP sniffing

Examples

Fuzz two hosts on port 6970 through interface eth0
ohrwurm -a 192.168.1.123 -b 192.168.1.15 -A 6970 -B 6970 -i eth0
Fuzz RTP traffic between two hosts using SIP sniffing for ports (default interface eth0, default BER 1.23%)
ohrwurm -a 192.168.1.123 -b 192.168.1.15
Fuzz with custom bit error ratio of 2.5%
ohrwurm -a 192.168.1.123 -b 192.168.1.15 -e 2.5
Fuzz using specific random seed 12345
ohrwurm -a 192.168.1.123 -b 192.168.1.15 -s 12345
Fuzz while suppressing RTCP packets
ohrwurm -a 192.168.1.123 -b 192.168.1.15 -t
Fuzz through custom interface wlan0
ohrwurm -a 192.168.1.123 -b 192.168.1.15 -i wlan0
Show usage help
ohrwurm -h
Updated 2026-04-16kali.org ↗