Re: [MMUSIC] ICE candidate pairing and NAT64

🔓Dan Wing <> Wed, 22 July 2015 13:58 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id D54FF1A86E0 for <>; Wed, 22 Jul 2015 06:58:24 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.211
X-Spam-Status: No, score=-14.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id iX0wRjDorBQo for <>; Wed, 22 Jul 2015 06:58:22 -0700 (PDT)
Received: from ( []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id BEF3C1A3BA1 for <>; Wed, 22 Jul 2015 06:58:22 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=5999; q=dns/txt; s=iport; t=1437573502; x=1438783102; h=mime-version:subject:from:in-reply-to:date:cc: content-transfer-encoding:message-id:references:to; bh=5KN9qx48u+oiO8rPxBcGTHyA+BSu3N7rK6sTxOa3q1Y=; b=co2HfhJLCqiPqo9ZkMPTgH/5xc0ktJ/Ttx8YdYOgC4B+Ny3xj6JRWngC 8daoAusAzDBMWdh6mGExBObpVQf130DqsZTEFtV9+bP9W7rAHS7bWpWOz s1hoXbHAKpVH2Mvbl4E4jBEwRHys5VeYwojZgFJrh7xydJ1bs/Dt9knSG 0=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.15,523,1432598400"; d="scan'208";a="13947463"
Received: from ([]) by with ESMTP; 22 Jul 2015 13:58:21 +0000
Received: from [] ([]) by (8.14.5/8.14.5) with ESMTP id t6MDwGmE020412 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Wed, 22 Jul 2015 13:58:20 GMT
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2098\))
From: 🔓Dan Wing <>
In-Reply-To: <>
Date: Wed, 22 Jul 2015 15:58:16 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <>
To: Ari Keränen <>
X-Mailer: Apple Mail (2.2098)
Archived-At: <>
Cc: Jonathan Lennox <>, mmusic <>
Subject: Re: [MMUSIC] ICE candidate pairing and NAT64
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Multiparty Multimedia Session Control Working Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 22 Jul 2015 13:58:25 -0000

On 22-Jul-2015 03:09 pm, Ari Keränen <> wrote:
> Hi,
> I agree that candidates from NAT64 setups would be useful. But I wonder what's the best way to discover them without adding too much complexity. In particular I'd prefer single mechanism that works across all (/many) cases.
> If there is also DNS64 in use, discovering IPv4 STUN/TURN server via that would result in NAT64 translated server reflexive addresses. This seems to be fine according to the STUN RFC [1] and STUN bis [2].

Yes, that should work with NAT64.

> In that case prefix discovery would not be needed.

Well, prefix discovery can still be useful, because the NAT64 might not be BEHAVE-friendly (specifically I am referring to address-dependent mapping, where the local ICE client has to send packets towards the remote ICE peer).  Maybe there aren't any NAT64s with address-dependent mapping behavior, but I worry there is a vendor or two that implemented such a thing.  I wonder if RIPE Atlas probes could do such testing of NAT64s they are behind?

> Or if it is used in parallel, one should probably check that the same prefix is not discovered twice?

Yeah, that's another check that should be written down.

> And how about the 464XLAT case?

I don't know, because I don't know if the ICE client would be aware of 464xlat; the IPv4 interface could look very 'real'.  And if 

> I think these should be prioritized like IPv4 server reflexive candidates.
> And at least so far seems to go to the category of "simple fixes" and hence good for ICEbis.


> Cheers,
> Ari
> [1]
> [2]
> On 24/06/15 17:57, 🔓Dan Wing wrote:
>> On 24-Jun-2015 08:35 am, Jonathan Lennox <> wrote:
>>>> On Jun 23, 2015, at 9:21 PM, 🔓Dan Wing <> wrote:
>>>> On 23-Jun-2015 12:28 pm, Jonathan Lennox <> wrote:
>>>>> Apple’s recent announcement that all iOS apps are soon going to be required to support running behind NAT64 has led me to contemplate what this means for ICE.
>>>>> Should ICE endpoints be required and/or recommended to support using RFC 7050 NAT64 prefix discovery to pair local IPv6 candidates which have a NAT64 gateway with remote IPv4 candidates?
>>>> Yes.
>>>>> What does this do to connectivity check pacing, or to the total number of connectivity checks?
>>>> It means an IPv6-only device with a NAT64 has same number of candidates as a dual-stack device.  I would pace and prioritize NAT64 addresses exactly same as IPv4 addresses would be paced and prioritized on a dual-stack host.
>>> The issue that occurred to me (having thought about this some more) is that if you’re on a 464XLAT network, I don’t think you want to have the application do its own RFC 7050 pairing — instead, you probably want to use the 464XLAT interface to pair with remote IPv4 candidates.
>>> Unfortunately, I don’t see any easy way for an application to be able to tell the difference between being on a device with 464XLAT (which will appear as an IPv6 local address with NAT64 plus a private address space IPv4 address) vs. a device with NAT64 on one interface and IPv4 on another (e.g. cellular data plus wi-fi).
>> I had remembered 464XLAT used a special IPv4 address for its CLAT, but reading RFC6877 now, I am mis-remembering (or it was deemed a bad idea and pulled from the eventual RFC).
>>> In the latter case, essentially what an ICE stack needs to do is application-layer 464XLAT for the NAT64 candidates, but doing it redundantly for the former case seems like a bad idea.  Any thoughts, other than deep knowledge of device configuration?
>>>>> And how many operating systems can support a userspace app doing an RFC 7050 DNS lookup on a per-interface basis?  (Even if you roll your own DNS resolver, you still need to be able to obtain per-interface DNS server configuration information to find the interface’s appropriate DNS64 server.)
>>>> Dunno.  MIF was going to solve that.  I will note that dnsmasq appears capable of sending DNS requests out certain interfaces (see the --server option at, so it must be relatively possible?
>>> It’s not just a matter of which interface you use to send the request, but which interface’s configuration information you use to discover the DNS server.  (Consider a dual-SIM device which can connect to  two different carriers’ cellular data networks, both of which are using NAT64.)
>> Yes, good point.  I agree if all the DNS & DNS64 servers learned from each interface is munged together (like it is with the traditional /etc/resolv.conf), we can't be successful at building synthetic NAT64 addresses.  That's what MIF was going to fix.  I know Dmitry Anipko was making good progress at keeping the learned DNS server from each interface separate on Windows, mostly for split-horizon support [e.g., enterprise VPN] but per-interface DNS64 is exactly the same split-horizon problem.  The learned DNS servers, and the interface each DNS server was learned from, need to be available to the application.  On OSs where that isn't possible, I think worst case is some additional ICE candidates and additional ICE connectivity checks, which will fail?
>> -d
>> _______________________________________________
>> mmusic mailing list