Subject: [MMUSIC] connectivity check when on Symm-Nat ?

From: Vikram Bhuskute <[email-masked]>
Date: Thu, 23 Nov 2006 13:07:49 +0530

Hi All,
         Was trying to figure out how ICE clients should behave when
both of  them are behind Symmatric nat. Following points are based on my
understanding .Please correct me.

Lets say Client A and B want to communicate with each other and both are
behind different NAT , both being Symmetric.
Lets Assume both are using same STUN server.

1. Client A & B has three sets of candidates 1. Host 2. Reflaxive and 3.
Relay. Connectivity check will fail for 1 and 2 as they are behind
Symm-nat.

2.In order to validate connectivity through relay address , Client A
run connectivity check for Relay candidate. Here is the problem I am
facing to visualize the operation. 
  2.1 Client will have to send STUN request to Relayed Address sitting
on Stun Server  ? (Which is Actually it is destined to other client B)
Relayed node will re-write the source address and sent to the  client B.
   
   2.2 Client B will send back the response to Relayed Address .While
preparing response what will be content of Mapped-Address Client B has
to fill ? Relay address ? 
    2.3 Client B's response will come back to Client A via Relay , And
it will try to match Mapped address with source address ? which will not
match ?? what it will do in such a case ....

3.  Was trying to find answer on my own in ice-12 ..following saction
confused me ..frankly couldn't understand much out of it. 

  Section 8.2 Server Procedures  : ( Paragraph  3)
   .
   .
   For requests being received on a relayed candidate, the source
   transport address used for STUN processing (namely, generation of the
   XOR-MAPPED-ADDRESS attribute) is the transport address as seen by the
   relay.  That source transport address will be present in the REMOTE-
   ADDRESS attribute of a STUN Data Indication message, if the Binding
   Request was delivered through a Data Indication.  
   If the Binding Request was not encapsulated in a Data Indication, that source
   address is equal to the current active destination for the STUN relay
   session.

3.1  Acc to my understanding Client use "Send Indication" to encapsulate
data and not "data indication"

3.2 What is the meaning of "source  address is equal to the current
active destination for the STUN relay  session" ???

I might be asking stupid questions ..but pardon me ...

Thanks in advance 

regards

Vikram

_______________________________________________
mmusic mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mmusic

---

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 27 Nov 2006 17:22:59 -0500

inline.

> Relayed node will re-write the source address and sent to the  client B.

For the check from A's relayed candidate to B's relayed candidate, yes. 
Note that you may not need to go this far down the pair priority list. 
In many cases, a check using a single relay will work, as long as the 
symmetric NAT on one side allocates its bindings from a single IP address.

Yes. ICE explicitly calls this out:

> Rosenberg                Expires April 26, 2007                [Page 30]
> 
> Internet-Draft                     ICE                      October 2006
> 
> 
>    Request was delivered through a Data Indication.  If the Binding
>    Request was not encapsulated in a Data Indication, that source

> match ?? what it will do in such a case ....

The mapped address will equal the relayed candidate. So the pair that 
gets added to the valid list is that address (its own relayed candidate) 
plus the destination address of that check (whcih was the relayed 
candidate of the remote side).

>    address is equal to the current active destination for the STUN relay

Right, this is directly addressing this case.

> data and not "data indication"

Right - but we are talking about what an ICE agent does when it 
*receives* a stun request from its peer. If that stun request was 
delivered through a relay, it arrives via a Data Indication sent by the 
relay.

> active destination for the STUN relay  session" ???

TURN allows the agent to set an active destination for packets. This is 
like a "default" address. WHen the agent wants to send a packet, it 
doesn't need to use a Send Indication if the packet is targeted towards 
that default. Similarly, the relay doesn't need to use a Data indication 
when a packet comes from that default. So, if the agent receives a 
packet from the relay, and its a regular data packet (not an indication 
or a stun response), the effective source address of that packet is the 
one when it arrived at the relay. This will be equal to this default 
address; if it wasn't, the packet would have been forwarded to the 
client as a Data Indication.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
[email-masked]                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com