Subject: [Ietf-behave] TURN Issue #6: port numbers

From: Jonathan Rosenberg <[email-masked]>
Date: Mon, 5 Dec 2005 12:33:51 -0800 (PST)

Right now, TURN has no default port. Its marked as XXXX in the spec. 
With the view that TURN would be a stun usage, its not clear that it 
needs a separate port from the STUN port. The only reason to have that 
is if folks think there is a desire from firewall admins to block TURN 
by disabling its port, but allow STUN. There are a few options here:

1. TURN will reuse the STUN default port. DNS procedures also exist to 
detect the udp, tcp, etc. ports for STUN/TURN, but they are always shared.

2. TURN has a separate default port. DNS procedures also exist to detect 
the udp, tcp, etc. ports for STUN, and there is also a procedure to 
detect them for TURN. This would be done by defining a separate NAPTR 
service for Allocate requests.

3. TURN will reuse the STUN default port. DNS procedures also exist to 
detect the udp, tcp, etc. ports for STUN, and there is also a procedure 
to detect them for TURN. This would be done by defining a separate NAPTR 
service for Allocate requests.

4. TURN has a separate default port, and there are no DNS procedures 
defined at all for STUN or TURN. This would imply a specific solution to 
the TLS problem in Issue #5 (in particular, would imply no DNS-based 
solutions). Why do this? The only reason is to force usage of TURN over 
a specific port since no discovery mechanism would exist. This would 
facilitate firewall port-blocking. Of course, its easily circumvented 
through configuration of the TURN port (which is what is done today), 
but its an option.

I tend to prefer #1 for simplicity. Unless there is a compelling 
argument brought about why the TURN and STUN requests NEED to run on 
different ports, I see no reason for anything else.

-Jonathan R.

--
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@xxxxxxxxx                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com

---

From: Cullen Jennings <[email-masked]>
Date: Tue, 13 Dec 2005 20:36:30 -0800 (PST)

If STUN and TURN are on the same port, it make it much harder to right rate
limiting rules for them. I don't know if this matters much but worth a bit
of thought.

---

From: Jonathan Rosenberg <[email-masked]>
Date: Tue, 20 Dec 2005 09:58:04 -0800 (PST)

I'm not sure; when TURN is used it generates a LOT more traffic than 
stun because of the media relaying. So, if you design your firewall to 
rate limit at a rate equal to the max TURN rate + a small percentage for 
the stun, that would work, no?

-Jonathan R.

Cullen Jennings wrote: