RFC 7362
Latching: Hosted NAT Traversal (HNT) for Media in Real-Time Communication
RFC 7362 ✨ (Part 1 of 4)
Okay bestie, let's get into it 💖 This RFC is called Latching: Hosted NAT Traversal (HNT) for Media in Real-Time Communication 🦋 It came out in September 2014 from the IETF (Internet Engineering Task Force). The category is Informational, which means it's published for info and is not a Standards Track spec 🌸 The authors are E. Ivov (Jitsi), H. Kaplan (Oracle), and D. Wing (Cisco). The ISSN is 2070-1721. The title block doesn't list anything it obsoletes or updates, so no drama there 💅
Abstract ✨
So this doc describes what signaling intermediaries do in Real-Time Communication (RTC) setups, aka Session Border Controllers (SBCs), when they're doing Hosted NAT Traversal (HNT) 🧚 HNT is a bundle of tricks, like media relaying and latching, that these middlemen use so RTC devices stuck behind NATs can still talk to each other 💜
This doc is non-normative 🙈 It's only here to explain HNT, giving the Internet community a reference and giving manufacturers and users something informative to read.
Latching is one of the HNT pieces, and it has a bunch of security issues covered in here 💀 Because of that, the IETF advises against using latching over the Internet unless every security consideration in here is taken into account and solved. It recommends other stuff instead, like Interactive Connectivity Establishment (ICE) 🔥
Status of This Memo ✨
This is not an Internet Standards Track spec. It's published for informational purposes 📚
This doc is a product of the IETF, and it represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). Not every IESG-approved doc is a candidate for any level of Internet Standard, so see Section 2 of RFC 5741 🌈
For info about the current status of this doc, any errata, and how to send feedback, check http://www.rfc-editor.org/info/rfc7362 🎀
Copyright Notice ✨
Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved.
This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please review these carefully, because they describe your rights and restrictions with respect to this doc 🧾 Code Components extracted from this doc must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License.
Table of Contents ✨
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Background . . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Impact on Signaling . . . . . . . . . . . . . . . . . . . . . 5
4. Media Behavior and Latching . . . . . . . . . . . . . . . . . 6
5. Security Considerations . . . . . . . . . . . . . . . . . . . 11
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 13
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 14
7.1. Normative References . . . . . . . . . . . . . . . . . . 14
7.2. Informative References . . . . . . . . . . . . . . . . . 141. Introduction ✨
Network Address Translators (NATs) are everywhere 🌍 consumers and organizations use them all the time. Specific NAT behaviors vary, but this doc uses the term "NAT" for devices that map any IPv4 or IPv6 address and transport port number to another IPv4 or IPv6 address and transport port number. That covers consumer NATs, firewall/NATs, IPv4-IPv6 NATs, Carrier-Grade NATs (CGNs) [RFC6888], etc. 💅
The Session Initiation Protocol (SIP) [RFC3261], and other protocols that try to use a more direct path for media than for signaling, are difficult to use across NATs 😭 These protocols put IP addresses and transport port numbers inside bodies like the Session Description Protocol (SDP) [RFC4566] and, in SIP's case, various header fields. Those addresses and ports are unusable unless all peers in a session are located behind the same NAT.
Mechanisms like Session Traversal Utilities for NAT (STUN) [RFC5389], Traversal Using Relays around NAT (TURN) [RFC5766], and Interactive Connectivity Establishment (ICE) [RFC5245] did not exist yet when protocols like SIP started getting deployed. Some mechanisms, like early STUN [RFC3489], had started showing up, but they were unreliable and had a bunch of issues typical of UNilateral Self-Address Fixing (UNSAF), as described in [RFC3424]. For these and other reasons, Session Border Controllers (SBCs) that SIP domains were already using for other SIP and media-related purposes started using proprietary mechanisms to help SIP devices behind NATs talk across them. These mechanisms are often transparent to endpoints and rely on a dynamic address and port discovery technique called "latching" 🦋
The term often used for this behavior is "Hosted NAT Traversal (HNT)", though some manufacturers call it other names, like "Far-end NAT Traversal" or "NAT assist" 🎀 The systems that perform HNT are frequently SBCs as described in [RFC5853], although other systems, like media gateways and "media proxies," sometimes play the same role. For this doc, all of these systems are called SBCs, and the NAT traversal behavior is called HNT.
At the time of publication, a vast majority of SIP domains use HNT to enable SIP devices to communicate across NATs, even though ICE exists 🤷♀️ There are many reasons for this, but they aren't relevant to this doc's purpose, so they won't be discussed. It is worth pointing out, though, that current deployment levels of HNT and NATs make complete extinction of this practice highly unlikely in the foreseeable future 💀
The purpose of this doc is to describe the mechanisms often used for HNT at the SDP and media layers, so you can understand the implications and limitations they bring 🧠 The mechanisms are well known in the community, but publishing them in an IETF doc is useful for providing common terminology and a reference for related docs 📚
This doc does not try to make a case for HNT or present it as somehow better than alternatives like ICE 🙅♀️ Due to the security issues presented in Section 5, latching is considered inappropriate for general use on the Internet unless all security considerations are taken into account and solved. The IETF is instead advising the use of Interactive Connectivity Establishment (ICE) [RFC5245] and Traversal Using Relays around NAT (TURN) [RFC5766] 🫶
It's also worth mentioning that there are purely signaling-layer components of HNT too. One such component is briefly described for SIP in [RFC5853], but that's not the focus of this doc 👀
SIP uses lots of expressive primitives for message routing 🛣️ As a result, the HNT component for SIP is typically more implementation-specific and deployment-specific than the SDP and media components. For this doc, it's therefore assumed that signaling intermediaries handle traffic in a way that lets protocols like SIP function correctly across the NATs ✨
The rest of this doc focuses mainly on HNT for SIP. However, the mechanisms here are fairly generic and are often used with other protocols too, like the Extensible Messaging and Presence Protocol (XMPP) [RFC6120], Media Gateway Control Protocol (MGCP) [RFC3435], Megaco/H.248 [RFC5125], and H.323 [H.323] 🌈
2. Background ✨
Okay so the general problems with NAT traversal for protocols like SIP are:
- The addresses and port numbers encoded in SDP bodies (or their equivalents) by NATed User Agents (UAs) aren't usable across the Internet, because they represent the UA's private network addressing information rather than the addresses/ports that the NAT will map to/from 😤
- The policies inherent in NATs, and explicit in firewalls, mean packets from outside the NAT can't reach the UA until the UA sends packets out first 🚧
- Some NATs apply endpoint-dependent filtering on incoming packets, as described in [RFC4787]. So a UA may only be able to receive packets from the same remote peer IP:port it sends packets out to 🙃
To overcome these issues, signaling intermediaries like SIP SBCs on the public side of the NATs perform HNT for both signaling and media 💖 An example deployment model of HNT and SBCs is shown in Figure 1 👇
+-----+ +-----+
| SBC |-------| SBC |
+-----+ +-----+
/ \
/ Public Net \
/ \
+-----+ +-----+
|NAT-A| |NAT-B|
+-----+ +-----+
/ \
/ Private Net Private Net \
/ \
+------+ +------+
| UA-A | | UA-B |
+------+ +------+Figure 1: Signaling and Media Flows in a Common Deployment Scenario 🍓
3. Impact on Signaling ✨
okay so session setup signaling is carrying more than just codec info 👀 it also carries addressing info that might be private and not routable on the global Internet 🙈 which is a whole problem. so signaling intermediaries step in and swap that info out, so the peer UAs get the (public) address of a media relay the intermediary controls. iykyk 💅
in typical deployments the media relay and the signaling intermediary (aka the SBC) are co-located, so they share the same IP address 🫶 and the relay's address usually belongs to the same IP address family as the one used for signaling (because that's the one we already know works for that UA). so signaling and media both travel over either IPv4 or IPv6, no mixing it up 🦋
the port numbers the intermediary puts into the signaling are typically allocated dynamically 🎀 and the allocation strategies are totally up to each implementation, which means they often vary from one product to the next. so don't expect them to match 💀
now the offer/answer media negotiation model [RFC3264] is lowkey intense 😭 once an offer is sent, the generator of that offer has to be ready to receive media on the advertised address/ports. but in practice that media may or may not actually show up 🤷♀️ it depends on the implementations in the session, local policies, and the call scenario. for example, if a SIP SDP offer came from a UA sitting behind a NAT, the SIP SBC can't send media to it until an SDP answer is given to the UA and latching (Section 4) happens 🌸
another example: when a SIP SBC sends an SDP offer in a SIP INVITE to a residential customer's UA and gets SDP back in a 18x response, the SBC may decide, for policy reasons, to hold off on sending media to that customer UA until a SIP 200 response has been received (e.g., to prevent toll fraud). the policy dedication is giving main character energy 👑
4. Media Behavior and Latching ✨
so a UA behind a NAT streams media from an address and port number (an address:port tuple) that only make sense inside its local network 🏠 once those packets cross the NAT, that tuple gets mapped to a public one. but the UA usually has no idea about the public mapping 😭 so it ends up advertising its private address:port tuple in signaling anyway.
this is the messy part: while the session is still being set up, the signaling intermediary doesn't know yet which addresses and ports the caller and callee will actually use for media 💀 it only ever saw the private addresses they advertised from behind their respective NATs. that's why media relays used in HNT often rely on a mechanism called "latching" 🧚
historically, "latching" only referred to the process where SBCs "latch" onto UDP packets from a given UA for security purposes, and "symmetric-latching" is when those latched address:port tuples get used to send media back to the UA. today most people just call both of them "latching," so this document does too 💜
the latching mechanism works like this:
- after receiving an offer from Alice (User Agent Client (UAC) located behind a NAT), a signaling intermediary on the public Internet allocates a set of IP address:port tuples on a media relay 🎀 that set then gets advertised to Bob (User Agent Server (UAS)) so he uses those media relay address:port tuples for all the media he wants to send toward Alice (UAC).
- next, after receiving Bob's (UAS) answer to its offer, the signaling server allocates a second address:port set on the media relay ✨ in its answer to Alice (UAC), the SBC swaps Bob's address:port for this second set. that way Alice sends media to this media relay address:port.
- the media relay receives the media packets on the allocated ports and uses their respective source address:ports as the destination for all media going the opposite direction. in other words, it "latches" or locks onto these source address:port tuples 🔒
- so when Alice (UAC) streams media toward the media relay, it gets received on the second address:port tuple 🦋 the source address:port of her traffic belongs to the public interface of Alice's NAT, and anything the relay sends back to that address:port finds its way to Alice 💖
- same deal in the other direction: the source of the media packets Bob (UAS) is sending gets latched onto and used for media going that way 🌈
- latching is usually done only once per peer 🙅♀️ and it isn't allowed to change or cause a re-latching until a new offer and answer get exchanged (e.g., in a subsequent call or after a SIP peer has gone on and off hold). the reasons are mostly security related 🔐 once a session has started, a user agent isn't expected to suddenly start streaming from a different port without sending a new offer first, because a change may be an attempt to hijack the session 😱 in some cases though, a port change may just be caused by a re-mapping in a NAT device standing between the SBC and the UA. more advanced SBCs may therefore allow some flexibility on the re-latching restrictions while carefully considering the potential security implications of doing so 🫶
Figure 2 shows how latching happens for SIP where HNT is provided by an SBC connected to two networks: 203.0.113/24 facing the UAC network and 198.51.100/24 facing the UAS network 🗺️
192.0.2.1 192.0.2.9/203.0.113.4 198.51.100.33
Alice NAT 203.0.113.9-SBC-198.51.100.2 Bob
------- --- --- -------
| | | |
1. |--SIP INVITE+offer c=192.0.2.1--->| |
| | | |
2. | | (SBC allocates 198.51.100.2:22007 |
| | for inbound RTP from Bob) |
| | | |
3. | | |-----INVITE+offer----->|
| | | c=198.51.100.2:22007 |
| | | |
4. | | |<------180 Ringing-----|
| | | |
| | | |
5. |<------180 Ringing----------------| |
| | | |
6. | | |<------200+answer------|
| | | |
7. | | (SBC allocates 203.0.113.9:36010 |
| | for inbound RTP from Alice) |
| | | |
8. |<-200+answer,c=203.0.113.9:36010--| c=198.51.100.33 |
| | | |
9. |------------ACK------------------>| |
10. | | |----------ACK--------->|
| | | |
11. |=====RTP,dest=203.0.113.9:36010==>| |
| | | |
12. | | (SBC latches to |
| | source IP address and |
| | port seen at (11)) |
| | | |
13. | | |<======= RTP ==========|
| | |dest:198.51.100.2:22007|
14. |<=====RTP, to latched address=====| |
| | | | Figure 2: Latching by a SIP SBC across Two InterfacesXMPP implementations often lean on ICE for NAT traversal 🌷 but some also support a non-ICE transport called XMPP Jingle Raw UDP Transport Method [XEP-0177]. Figure 3 shows how latching works for one such XMPP implementation, where HNT is provided by an XMPP server on the public Internet 💜
192.0.2.1 192.0.2.9/203.0.113.4 203.0.113.9 198.51.100.8
Romeo NAT XMPP Server Juliet
----- --- --- -----
| | | |
1. |----session-initiate cand=192.0.2.1--->| |
| | | |
2. |<------------ack-----------------------| |
| | | |
3. | | (Server allocates 203.0.113.9:2200 |
| | for inbound RTP from Juliet) |
| | | |
4. | | |--session-initiate-->|
| | |cand=203.0.113.9:2200|
| | | |
5. | | |<--------ack---------|
| | | |
| | | |
6. | | |<---session-accept---|
| | | cand=198.51.100.8 |
| | | |
7. | | |---------ack-------->|
| | | |
8. | | (Server allocates 203.0.113.9:3300 |
| | for inbound RTP from Romeo) |
| | | |
9. |<-session-accept cand=203.0.113.9:3300-| |
| | | |
10. |-----------------ack------------------>| |
| | | |
| | | |
11. |======RTP, dest=203.0.113.9:3300======>| |
| | | |
12. | | (XMPP server latches to |
| | src IP 203.0.113.4 and |
| | src port seen at (11)) |
| | | |
13. | | |<======= RTP ========|
| | |dest=203.0.113.9:2200|
14. |<======RTP, to latched address=========| |
| | | | Figure 3: Latching by an XMPP Server across Two Interfacesthe stuff above is a general description, and some details vary between implementations or configuration settings 🎀 for example, some intermediaries do extra logic before latching onto received packet source information, to guard against malicious attacks or against latching onto the wrong previous media sender, often called "rogue-rtp" in the industry 🕵️♀️💅
It is worth pointing out that latching is not exclusively a "server affair" 💅. Some clients can use it too, like when they have a public IP address and get contacted by a NATed client that has no other NAT traversal option 🦋.
For latching to work, the UA behind the NAT needs to support symmetric RTP 🎀. That means it has to send from the same ports it listens on for inbound packets. Right now that's basically true for almost all SIP and XMPP clients ✨. The UAs also need to be able to start sending media on their own, without waiting for packets to show up first. In theory, a UA might not send anything first, like if a SIP session starts in 'inactive' or 'recvonly' SDP mode from the UA behind the NAT 🙈. But in practice, SIP sessions from regular UAs (the kind you'd actually find behind a NAT) almost never start in 'inactive' or 'recvonly' mode, and it's easy to see why 💀. The media direction could also be a problem if the SBC side sends 'inactive' or 'sendonly' modes in the SDP it gives the UA. Still, SBCs providing HNT are always set up to avoid this 🫶.
Now here's the tricky part 🌸. Latching means media relays have to start receiving before they can start sending. That opens the door to deadlocks 😭. It can happen when the UAC and the UAS in a session connect through different signaling intermediaries that both provide HNT. Then the media relays controlled by those signaling servers could each sit there waiting for the other one to start streaming 🙃. To avoid this, relays often try to start streaming toward the address:port tuples given in the offer/answer, even before any inbound traffic shows up 🧚. If the entity they're streaming to is another HNT-performing server, it would have given out its relay's public address and ports, so that early stream finds its target 🎯.
Many SBCs only support UDP-based media latching (especially for RTP/RTCP), but plenty also support TCP-based media latching 💜. TCP latching is more complicated 🙃. It means forcing the UA behind the NAT to be the TCP client, so it sends the initial SYN-flagged TCP packet to the SBC. In other words, it has to be the 'active' mode side of a TCP-based media session 🔥. If both UAs in a TCP-based media session are behind NATs, SBCs typically force both UAs to be TCP clients, and the SBC splices the TCP connections together 🪡. TCP splicing is a well-known technique, as described in [TCP-SPLICING].
HNT and latching generally work reliably 👑, but they have some obvious caveats. The first one IETF participants usually bring up is that UAs aren't aware it's happening 👀. That makes it impossible to use the mechanism with protocols like ICE, which try different traversal techniques to pick the one that fits best ❌. Overwriting address information in offers and answers may even completely stop UAs from using ICE, because of the ice-mismatch rules described in [RFC5245] 💅.
The second issue IETF participants raise is that media goes through a relay instead of flowing directly over the IP-routed path between the two UAs 🌈. That has real drawbacks, like reduced scalability and higher latency. But SBC administrators see it as a benefit too 🍓. If a customer pays for "phone" service, for example, the media is literally what they're paying for. Admins usually want to detect that the media is flowing correctly, evaluate its quality, and know if and why it failed ✨. Also, routing media through operator-controlled relays can sometimes send it over paths that are explicitly optimized for media, which can give better performance than regular Internet routing 🚀.
5. Security Considerations 🔐
A common worry is that an SBC (or an XMPP server, since all security considerations apply to both) that implements HNT might latch onto the wrong or even malicious sources 😱. The ICE [RFC5245] protocol, for example, provides authentication tokens (carried in the ice-ufrag and ice-pwd attributes). These let you confirm a peer's identity before you start media exchange with her 🛡️. Without that authentication, a malicious source could launch a resource exhaustion attack by flooding every possible media-latching UDP port on the SBC, so calls can't succeed 💀. SBCs have various mechanisms to stop this or at least alert an administrator when it happens 🚨. Still, a sufficiently sophisticated attacker might get past them for a while 🕵️.
The most common example is called "restricted-latching" 🔒. The SBC won't latch to any packets from a source public IP address other than the one the SIP UA uses for SIP signaling. That way, the SBC just ignores packets from the attacker and doesn't latch onto them 🙅♀️. In some cases, the limitation may be loosened to allow media from a range of IP addresses that belong to the same network. That helps with use cases like decomposed UAs and various forms of third-party call control 🧩. But relaxing the restrictions this way could give attackers a bigger attack surface 📈, so these configurations are generally only set up on a case-by-case basis. That way, the specifics of each deployment can be taken into account 🎀.
All of the above problems would still happen if the attacker knows the public source IP of the UA that's actually making the call 😬. The attacker could then flood all of the SBC's public IP addresses and ports with packets spoofing that SIP UA's public source IP address. But that would only affect media from that IP (or range of IP addresses), not every call the SBC is handling 🙌.
A malicious source could also send media packets to an SBC media-latching UDP port, hoping to get latched onto so it receives media for a given SIP session 🎣. SBCs have various mechanisms to prevent this too. Restricted latching, for example, helps here as well. The attacker can't make the SBC send media packets back to them, because the SBC won't latch onto the attacker's media packets without having seen the corresponding signaling packets first 🛑. There could still be an issue if the attacker is either (1) in the IP routing path, where it can spoof the same IP as the real UA and get the media coming back. In that case, the attacker hardly needs to attack at all to begin with 🫠. Or the attacker could be (2) behind the same NAT as the legitimate SIP UA. Then the attacker's packets will be latched onto by the SBC, and the SBC will send media back to the attacker 😱. In the second case, which may be especially concerning with Carrier-Grade NATs, the legitimate SIP UA will probably end the call anyway when a human user hears nothing and hangs up 📞. For a non-human call participant, like an answering machine, that might not happen. Though many automated UAs would also hang up when they don't receive any media 🤖. The attacker could also redirect all media to the real SIP UA after receiving it. If so, the attack would likely stay undetected and succeed 💔. This is again a particular concern with larger-scale NATs serving many different endpoints, such as Carrier-Grade NATs 🏢. The more devices a NAT fronts, the more use cases vary, and the more possible attack vectors grow 📊.
Naturally, Secure RTP (SRTP) [RFC3711] would help mitigate these threats 🔐. With the right key negotiation mechanisms, it would protect the media from monitoring while it's in transit 👀. So it should be used independently of HNT. Section 26 of [RFC3261] gives an overview of additional threats and solutions for monitoring and session interception 🕵️♀️.
With SRTP, if the SBC doing the latching is actually taking part in the SRTP key exchange, it would simply refuse to latch onto a source unless it can authenticate that source 🙅. Failing to implement and use SRTP would be a serious threat to users connecting from behind Carrier-Grade NATs [RFC6888], and it's considered a harmful practice 🚫.
For SIP clients, HNT is usually transparent, meaning the SIP UA doesn't know it's happening 🫥. In certain cases it might be detectable. For example, when ICE is supported by the SIP UA and the SBC changes the default connection address and media port numbers in SDP, that disables ICE because of the mismatch condition ⚠️. Even then, though, the SIP UA only knows a middlebox is relaying media. It doesn't necessarily know it's doing latching/HNT 🤷♀️.
To perform HNT, the SBC has to modify SDP going to and coming from the SIP UA behind a NAT 📝. So the SIP UA can't use S/MIME [RFC5751]. It also can't sign a sending request or verify a received request with the SIP Identity mechanism [RFC4474], unless the SBC re-signs the request 🔏. But neither S/MIME nor SIP Identity is widely deployed, so not being able to sign or verify requests doesn't appear to be a concern right now 😌.
From a privacy angle, media relaying is sometimes seen as a way to protect your IP address and keep it hidden from the remote party 🫣. That kind of IP address masking is often considered important. But HNT isn't the only way to get it anymore 🙃. Client-controlled relaying mechanisms like TURN [RFC5766] can also do it, if the client explicitly wants that 🦋.
6. Acknowledgements 🫶
The authors would like to thank Flemming Andreasen, Miguel A. Garcia, Alissa Cooper, Vijay K. Gurbani, Ari Keranen, and Paul Kyzivat for their reviews and suggestions on improving this document 💖. You all are literal legends 👑.
7. References 📚
7.1. Normative References
[RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
A., Peterson, J., Sparks, R., Handley, M., and E.
Schooler, "SIP: Session Initiation Protocol", RFC 3261,
June 2002.
[RFC3264] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model
with Session Description Protocol (SDP)", RFC 3264, June
2002.
[RFC3711] Baugher, M., McGrew, D., Naslund, M., Carrara, E., and K.
Norrman, "The Secure Real-time Transport Protocol (SRTP)",
RFC 3711, March 2004.
[RFC4566] Handley, M., Jacobson, V., and C. Perkins, "SDP: Session
Description Protocol", RFC 4566, July 2006.
[RFC4787] Audet, F. and C. Jennings, "Network Address Translation
(NAT) Behavioral Requirements for Unicast UDP", BCP 127,
RFC 4787, January 2007.
[RFC5853] Hautakorpi, J., Camarillo, G., Penfield, R., Hawrylyshen,
A., and M. Bhatia, "Requirements from Session Initiation
Protocol (SIP) Session Border Control (SBC) Deployments",
RFC 5853, April 2010.
[RFC6120] Saint-Andre, P., "Extensible Messaging and Presence
Protocol (XMPP): Core", RFC 6120, March 2011.
[XEP-0177]
Beda, J., Saint-Andre, P., Hildebrand, J., and S. Egan,
"XEP-0177: Jingle Raw UDP Transport Method", XSF XEP 0177,
December 2009.7.2. Informative References 📚✨
okay so these are the informative ones, aka the "good to know" pile. nothing here is required reading to implement the thing, but they're the receipts 💅
[H.323]International Telecommunication Union, "Packet-based multimedia communication systems", ITU-T Recommendation H.323, December 2009.[RFC3424]Daigle, L. and IAB, "IAB Considerations for UNilateral Self-Address Fixing (UNSAF) Across Network Address Translation", RFC 3424, November 2002.[RFC3435]Andreasen, F. and B. Foster, "Media Gateway Control Protocol (MGCP) Version 1.0", RFC 3435, January 2003.[RFC3489]Rosenberg, J., Weinberger, J., Huitema, C., and R. Mahy, "STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs)", RFC 3489, March 2003.[RFC4474]Peterson, J. and C. Jennings, "Enhancements for Authenticated Identity Management in the Session Initiation Protocol (SIP)", RFC 4474, August 2006.[RFC5125]Taylor, T., "Reclassification of RFC 3525 to Historic", RFC 5125, February 2008.[RFC5245]Rosenberg, J., "Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal for Offer/Answer Protocols", RFC 5245, April 2010.[RFC5389]Rosenberg, J., Mahy, R., Matthews, P., and D. Wing, "Session Traversal Utilities for NAT (STUN)", RFC 5389, October 2008.[RFC5751]Ramsdell, B. and S. Turner, "Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.2 Message Specification", RFC 5751, January 2010.[RFC5766]Mahy, R., Matthews, P., and J. Rosenberg, "Traversal Using Relays around NAT (TURN): Relay Extensions to Session Traversal Utilities for NAT (STUN)", RFC 5766, April 2010.[RFC6888]Perreault, S., Yamagata, I., Miyakawa, S., Nakagawa, A., and H. Ashida, "Common Requirements for Carrier-Grade NATs (CGNs)", BCP 127, RFC 6888, April 2013.[TCP-SPLICING]Maltz, D. and P. Bhagwat, "TCP Splice for application layer proxy performance", Journal of High Speed Networks Vol. 8, No. 3, 1999, pp. 225-240, March 1999.
Authors' Addresses 🎀
and finally, the people who wrote this! here's where you can find them 🫶
Emil Ivov
Jitsi
Strasbourg 67000
France
EMail: emcho@jitsi.org
Hadriel Kaplan
Oracle
100 Crosby Drive
Bedford, MA 01730
USA
EMail: hadrielk@yahoo.com
Dan Wing
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134
USA
EMail: dwing@cisco.comthat's the whole thing, bestie 🌈👑 the end!! 💖
📦 where this page comes from
- ietf: rfc7362 2014-09
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms