AirCodec · Security
An unattended transmitter site is the softest thing on most station networks: a box in a locked building that answers anything that reaches it. AirCodec puts three checks between a caller and your audio, and you decide how tight each one is.
Three checks, in that order, on every incoming Direct link. Leave them all open for a bench test and tighten them before the game — it is per codec, not per machine.
Direct
A Direct link is AirCodec to AirCodec, usually studio to transmitter site, and usually across somebody else's network. It is the one with real exposure, so it is the one with the checks on it — and each is set per codec, so one channel can be wide open on the bench while another is locked down.
Accept Direct callers from is an allow list, checked before anything else. Anything not on it never reaches a password prompt.
Use it when both ends are fixed. A studio-to-transmitter link never needs to accept the whole internet.
The connection password is checked before the session is established. Without it there is no session and no audio — not a muted channel, nothing.
Use it always on anything facing the internet. It is also what turns on the encryption.
With a password set, the whole Direct link is encrypted with AES-256 — not just the control, the lot.
Worth knowing: encryption is Direct-only. Over a SIP call the audio travels through your SIP server and AirCodec does not encrypt it.
Open full size
It tells you when you are exposed. Leave the password off and the screen says so, in as many words: any AirCodec that reaches this port can connect, and the link is not encrypted. You never have to go looking for what is open — the tab you set it on is the tab that warns you.
SIP
The usual way a SIP endpoint gets compromised is a human choosing the username and password. AirCodec takes that choice away. The registration server generates both against your account, and for AirCodec's own codecs they are never typed by anybody at all.
Each codec's SIP username and connection password come from the server the first time that codec registers. Machine-generated, locked to that endpoint, masked on screen until you press Show.
A name is cleaned to letters, digits, dot and dash, and locked once claimed — so a second box cannot quietly take over a channel's identity by registering under the same name.
A Comrex or Tieline registered from Settings → Devices gets its own name and its own credentials, visible to everyone on the account and revocable from the same screen. One click and that unit is off.
Calls arrive by name through the registrar, so no address, port or hostname has to be given out for a remote to reach you — and none has to stay the same next week.
Open full size
Where SIP stops. SIP gets you reach and interoperability, not privacy: over a SIP call the audio travels inside the call through your SIP server, and AirCodec does not encrypt it. If what you are sending has to be private across the public internet, use a Direct link with a password.
The checks above decide who gets in. These decide whether the codec is listening at all, and what evidence you have afterwards. Both are set per codec, so a transmitter-site channel and a guest channel need not behave alike.
Untick it and this codec will not accept an AirCodec-to-AirCodec call at all, whatever the address or password. A codec that only ever dials out need not listen for anything.
Untick it and the codec stays registered and can still dial out, but nothing can call it. Useful on a channel that only ever originates.
A transmitter-site codec has to be answerable; a studio desk usually does not. Per codec, not per machine — with an optional ring-first delay of up to twenty seconds so a human in the room can take it instead.
Turn a codec off entirely and the registration server is told at once. It shows as off at the far end within seconds rather than at the next registration.
The SNMP agent is read-only. A monitoring system can poll every figure the codec knows and receive its traps, and it cannot change a single setting. Opening a codec to your NMS does not open it to anything else.
AirCodec
Tell us where the boxes sit and what the firewall between them looks like, and we will tell you which ports actually have to be open and which do not.
More on AirCodec
