Sonicwall Signatures

Go to All Categories list.
Go to All Applications list.

  H.248 Protocol -- UDP Activity (Megaco Reply)

Category: PROTOCOLS      

Application: H.248 Protocol      

Megaco (officially H.248) is an implementation of the Media Gateway Control Protocol architecture[1] for controlling media gateways in Internet Protocol (IP) networks and the public switched telephone network (PSTN).

The general base architecture for the Media Gateway Control Protocol and programming interface was originally described in RFC 2805 and the current specific Megaco definition is ITU-T Recommendation H.248.1.

Megaco defines the protocol for media gateway controllers to control media gateways for the support of multimedia streams across computer networks. It is typically used for providing Voice over Internet Protocol (VoIP) services (voice and fax) between IP networks and the PSTN, or entirely within IP networks.

The protocol was the result of collaboration of the MEGACO working group of the Internet Engineering Task Force (IETF) and International Telecommunication Union ITU-T Study Group 16. The IETF originally published the standard as RFC 3015, which was later replaced by RFC 3525. The term Megaco is the IETF designation. The ITU later took ownership of the protocol and IETF's version has been reclassified as historic. The ITU has published three versions of H.248.1, the most recent in September 2005.

H.248 encompasses not only the base protocol specification in H.248.1, but many extensions defined throughout the H.248 Sub-series.

This SonicWALL signature identifies legitimate H.248 Megaco (MGCP) UDP traffic between a Media Gateway Controller (MGC) and a Media Gateway (MG) over any UDP port. This signature identifies Megaco Reply.

Relevant Information