Re: [rtcweb] [Suspected Junk Mail] Importance of local addresses in ICE

Cullen Jennings <> Sun, 17 May 2015 21:14 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 1B57B1ACEC4 for <>; Sun, 17 May 2015 14:14:53 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.764
X-Spam-Status: No, score=0.764 tagged_above=-999 required=5 tests=[BAYES_50=0.8, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_SOFTFAIL=0.665] autolearn=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id P5ZV-CusboWJ for <>; Sun, 17 May 2015 14:14:51 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 45E0C1AD0C7 for <>; Sun, 17 May 2015 14:13:48 -0700 (PDT)
Received: from [] (unknown []) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPSA id 965FD509BB; Sun, 17 May 2015 17:13:46 -0400 (EDT)
Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2070.6\))
Content-Type: text/plain; charset="us-ascii"
From: Cullen Jennings <>
In-Reply-To: <>
Date: Sun, 17 May 2015 14:13:45 -0700
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <>
To: Justin Uberti <>
X-Mailer: Apple Mail (2.2070.6)
Archived-At: <>
Cc: "" <>
Subject: Re: [rtcweb] [Suspected Junk Mail] Importance of local addresses in ICE
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 17 May 2015 21:14:53 -0000

The problem with surfacing a single host IP is it is very hard to choose which one. As I pointed the idea of a default route is not as simple as one might think. For example, on some things the default route depends on the domain name you are trying to reach. 

> On Apr 29, 2015, at 4:54 PM, Justin Uberti <> wrote:
> Are you referring to our proposal where we surface the single host IP used for contacting the STUN/TURN servers, or surfacing all host IPs? I generally agree that surfacing a single host IP is important, especially given CGN as you mention, but surfacing all may have fingerprinting implications.
> It would be good to get empirical data on how often host-host occurs in the wild - if anyone is running a WebRTC service with p2p calls and can get data on the %age of host-host candidate calls, that would be greatly appreciated. (Hangouts is client-server.)
> On Sun, Apr 26, 2015 at 8:24 PM, Cullen Jennings <> wrote:
> There has been some suggestion that the ICE should not advertise candidates that were addresses from a NATed address space. I think it is critical that we do and here is why.
> Carrier Grade NATs (CGN) are becoming far more common in many countries. Most measures of them show they are not friendly towards over the top VoIP traffic (totally shocker given they are often deployed by people offering a commercial voice service as well). So when you have two user both behind the same GCN, if ICE does not expose the local address, all of the traffic is forced thought the GCN (which may have more jitter than you might hope) and to a TURN server. If the ICE contained the local candidates then media would go directly through between the devices.
> CGN while not that common in the US is prevalent in many countries - particularly ones that had less IPv4 addressed allocated to them.
> Now you can say that this might reveal some information about their IP address. But think about what we really wish the wold looked like. There was no NAT and they had a IPv6 address. I have a hard time seeing how to DHCP generated address behind the NAT is hugely different than a random allocated v6 address so I don't see much downside on doing this and I see huge upside - particularly for people that are working of a cellular data link behind a CGN.
> I am also think that in general, end to end is better for privacy than forcing all your data through a MITM that the user does not control (the TURN server and CGN in this case).
> _______________________________________________
> rtcweb mailing list