Grandstream Configuration Tool

Configuration Files Generator Tool for WINDOWS http://sourceforge.net/projects/provisioning/

Using the template file the configuration tool makes phone-specific configuration files, basically, it just reformats the config options into one line separated by ampersands and attaches its custom header

The custom header takes up the first 16 characters and only makes sense if viewed in a hex editor
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a

The mac address of the phone used in this example is 000b82000000
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a

Followed by two CRLF’s (Newlines)
00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a

The first 6 bytes don’t make a lot of sense but they appear to be some sort of verification code as if u change the contents and or length of the configuration options it will change changing the mac address it appears to go down 1 for every 1 the mac address goes up…

If anyone could shed some light on this particular part of the cfg file it would be great 🙂
I seem to get the feeling it is some sort of hash of the configuration options with the mac address subtracted from it …

00 00 00 44 58 1b 00 0b 82 00 00 00 0d 0a 0d 0a

Configuration File Format

The parameters are strung together without whitespace, ie:

P30=time.nist.gov&P63=1&P31=1

A “key” parameter (“&gnkey=0b82”) is then added to the parameter string. ie:

P30=time.nist.gov&P63=1&P31=1&gnkey=0b82

If the length of this parameter string is not even, a zero byte is added to the string,

A 16 byte “header” that is prepended to the resulting configuration string.

The header consists of:

• Byte 0x00: 0x00
• Byte 0x01: 0x00
• Byte 0x02: high byte of (length of parameter string) divided by 2
• Byte 0x03: low byte of (length of parameter string) divided by 2
• Byte 0x04: 0x00 (replaced by high byte of checksum)
• Byte 0x05: 0x00 (replaced by low bytes of checksum)
• Byte 0x06: first byte of device MAC address
• Byte 0x07: second byte of device MAC address
• Byte 0x08: third byte of device MAC address
• Byte 0x09: fourth byte of device MAC address
• Byte 0x0A: fifth byte of device MAC address
• Byte 0x0B: sixth byte of device MAC address
• Byte 0x0C: carriage return ( 0x0C )
• Byte 0x0D: line feed (0x0A)
• Byte 0x0E: carriage return ( 0x0C )
• Byte 0x0F: line feed (0x0A)

This results in a configuration string of:
16 bytes header + (configuration parameters) + (&gnkey=0b82) + (Padding byte if length is not even)

You then compute a 16-bit checksum (initial value 0x0000 – adding the value of each individual byte)
of the entire configuration string. This value is then subtracted from 0x10000 and placed in bytes 4 and
5 of the header, then the header and parameter strings are written to a binary file.

This format has been tested and confirmed with firmware versions ip to 1.0.6.0 of the grandstream and
BudgeTon and HandyTone devices.

Template

Grandstream do provide a template (with largely correct comments) on their website. However, as of June 2006, it only covered the 1.0.6 firmware family, and so doesn’t have the options for 1.0.8.x. However, if you view source on the phone’s HTTP configuration, you can see the new P numbers.

If you want to know parameters, you just have to edit the html source of the phone configuration pages.

Configuration Parameters

• P2: Admin Password
• P3: Display (CallerID) Name
• P8: IP Address Type ( 0 = DHCP, 1 = static )
• P9: Static IP Address – octet 0
• P10: Static IP Address – octet 1
• P11: Static IP Address – octet 2
• P12: Static IP Address – octet 3
• P13: Subnet Mask – octet 0
• P14: Subnet Mask – octet 1
• P15: Subnet Mask – octet 2
• P16: Subnet Mask – octet 3
• P17: Default Router – octet 0
• P18: Default Router – octet 1
• P19: Default Router – octet 2
• P20: Default Router – octet 3
• P21: DNS server 1 – octet 0
• P22: DNS server 1 – octet 1
• P23: DNS server 1 – octet 2
• P24: DNS server 1 – octet 3
• P25: DNS server 2 – octet 0
• P26: DNS server 2 – octet 1
• P27: DNS server 2 – octet 2
• P28: DNS server 2 – octet 3
• P29: Early Dial
• P30: NTP Time Server ( FQDN or IP Address )
• P31: SIP Registration ( 0 = do not register, 1 = register )
• P32: Register Expiration ( in minutes )
• P33: VoiceMail Dial String
• P34: Authentication Password
• P35: SIP User ID
• P36: Authenticate ID
• P37: Voice Frames per TX
• P38: Layer 3 QoS
• P39: Local RTP Port
• P40: Local SIP Port
• P41: TFTP server IP Address – octet 0
• P42: TFTP server IP Address – octet 1
• P43: TFTP server IP Address – octet 2
• P44: TFTP server IP Address – octet 3
• P47: SIP Server (FQDN or IP Address)
• P48: Outbound Proxy (FQDN or IP Address)
• P49: G723 Frame rate
• P50: Silence Suppression ( 0 = no, 1 = yes)
• P51: 802.1Q/VLAN Tag
• P52: STUN NAT Traversal ( 0 = no, 1 = yes)
• P57: Codec choice 1 ( 0 = g.711u, 8 = g.711u, 18 = g.729 )
• P58: Codec choice 2
• P59: Codec choice 3
• P60: Codec choice 4
• P61: Codec choice 5
• P62: Codec choice 6
• P46: Codec choice 7
• P98: Codec choice 8
• P63: User ID is phone number ( 0 = no, 1 = yes)
• P64: Timezone Offset ( Offset from GMT in minutes + 720, IE: MST (GMT – 7 hours) = -420 + 720 = 300 )
• P65: Send Anonymous ( 0 = no, 1 = yes)
• P66: Dial Plan Prefix
• P71: Offhook Auto Dial
• P72: Use # as Dial Key ( 0 = no, 1 = yes)
• P73: Send DTMF Type (0 = inband, 1 = RFC2833, 2 = SIP INFO)
• P74: Send Flash Event ( 0 = no, 1 = yes )
• P75: Daylight Savings Time ( 0 = no, 1 = yes)
• P76: STUN NAT Traversal Server
• P78: Use random port ( 0 = no, 1 = yes)
• P79: DTMF Payload Type ( defaults to 101 )
• P81: Unregister on Reboot ( 0 = no, 1 = yes)
• P82: PPPoE Account ID
• P83: PPPoE Password
• P84: Keep-Alive Interval
• P85: No Key Entry Timeout
• P87: 802.1p priority value
• P88: Lock keypad update ( 0 = no, 1 = yes)
• P90: Auto Answer ( 0 = no, 1 = yes)
• P91: Disable Call Waiting ( 0 = disabled, 1 = enabled)
• P96: iLBC payload type
• P97: iLBC frame size
• P99: Subscribe for MWI
• P101: Use NAT IP ( 0 = no, 1 = yes)
• P102: Date Display Format
• P103: Use DNS SRV ( 0 = no, 1 = yes)
• P104: Default Ring Tone
• P191: Enable Call Features ( 0 = no, 1 = yes)
• P192: HTTP Firmware Update Server (also TFTP server if P212 is set to TFTP, on 1.0.8.x)
• P193: Firmware Check Interval (in minutes in 1.0.8.x)
• P194: Auto Update ( 0 = no, 1 = yes)
• P197: Proxy-Require ( 0 = no, 1 = yes)
• P212: Firmware Upgrade ( 0 = TFTP Upgrade, 1 = HTTP Upgrade )
• P232: Firmware File Prefix (1.0.8.x)
• P233: Firmware File Suffix (1.0.8.x)
• P234: Config File Prefix (1.0.8.x)
• P235: Config File Suffix (1.0.8.x)
• P237: TFTP/HTTP Config Server (based on P212, 1.0.8.x)
• P238: Check for new Firmware ( 0 = Every time, 1 = only when suffix/prefix changes, 2 = Never – 1.0.8.x)

HandyTone Specific Parameters

• P86: FXS Impedance:: 0 = 600ohm (North America) (1 = 900ohm , 2 = 600ohm+2.16uF, 3 = 900ohm+2.16uF, 4 = CTR21, 5 = Australia / New Zealand, 6 = Slovenia / Slovakia / South Africa, 7 = New Zealand #2)
• P110: Lan Subnet Mask
• P111: Lan DHCP Base IP Address
• P112: DHCP IP Lease Time
• P113: LAN DMZ IP Address
• P150: Port Forwarding entry 1 – WAN Port
• P151: Port Forwarding entry 2 – WAN Port
• P152: Port Forwarding entry 3 – WAN Port
• P153: Port Forwarding entry 4 – WAN Port
• P154: Port Forwarding entry 5 – WAN Port
• P155: Port Forwarding entry 6 – WAN Port
• P156: Port Forwarding entry 7 – WAN Port
• P157: Port Forwarding entry 8 – WAN Port
• P158: Port Forwarding entry 1 – LAN IP
• P159: Port Forwarding entry 2 – LAN IP
• P160: Port Forwarding entry 3 – LAN IP
• P161: Port Forwarding entry 4 – LAN IP
• P162: Port Forwarding entry 5 – LAN IP
• P163: Port Forwarding entry 6 – LAN IP
• P164: Port Forwarding entry 7 – LAN IP
• P165: Port Forwarding entry 8 – LAN IP
• P166: Port Forwarding entry 1 – LAN Port
• P167: Port Forwarding entry 2 – LAN Port
• P168: Port Forwarding entry 3 – LAN Port
• P169: Port Forwarding entry 4 – LAN Port
• P170: Port Forwarding entry 5 – LAN Port
• P171: Port Forwarding entry 6 – LAN Port
• P172: Port Forwarding entry 7 – LAN Port
• P173: Port Forwarding entry 8 – LAN Port
• P174: Port Forwarding entry 1 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P175: Port Forwarding entry 2 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P176: Port Forwarding entry 3 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P177: Port Forwarding entry 4 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P178: Port Forwarding entry 5 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P179: Port Forwarding entry 6 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P180: Port Forwarding entry 7 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P181: Port Forwarding entry 8 – Protocol ( 0 = UDP, 1 = TCP 2 = Both )
• P115: Cloned WAN MAC Address – Octet 0
• P116: Cloned WAN MAC Address – Octet 1
• P117: Cloned WAN MAC Address – Octet 2
• P118: Cloned WAN MAC Address – Octet 3
• P119: Cloned WAN MAC Address – Octet 4
• P120: Cloned WAN MAC Address – Octet 5
• P190: Enable WAN Side HTTP Access
• P195: PSTN Access code (default: *00)
• P196: End-User password
• P198: SPECIAL FEATURES ( 100 = standard, 101 = Nortel MCS, 102 = Broadsoft, 103 = Howdy )
• P200: Caller ID Scheme, 0 = Bellcore, 1 = ETSI-FSK (France, Germany, Norway, Taiwan, UK-CCA), 2 = ETSI DTMF (Finland, Sweden), 3 = Denmark-DTMF
• P205: Polarity Reversal. 0 – No, 1 – Yes.
• P206: 1 = 18V, 2 = 36V, 3 = 48V, 4 = 51V, 5 = 24V
• P231: HandyTone Revision 2 Hardware – Bridge between WAN and LAN port. 1=yes, 0=no
• P228: FAX Mode 0 – T.38 (Auto Detect), 1 – Pass Through
• P1340: Disable Do Not Disturb. 0 – no, 1 – yes

See Also

• Bash script to remote reboot some Grandstream phones