Re: [rtcweb] Same location media

[Roman Shpount <[e-mail]>]

On Thu, Oct 20, 2011 at 1:02 PM, Bernard Aboba <[e-mail]>wrote:

>  [BA] With respect to TURN with TCP/TLS we have found some firewalls that
> actually do deep packet inspection.  So if you're sending to TCP port 80 and
> aren't using HTTP, or are sending to port 443 and aren't using TLS (or are
> using TLS extensions the firewall doesn't understand), the firewall can
> block.   So yes, it is important to support TURN with TCP/TLS, but it should
> be recognized that even with that, there will still be a significant
> percentage of failures.
>

TURN over TLS is non-distinguishable (unless I am missing something) from
HTTPS connection. It is using the same TLS transport as HTTPS and firewall
cannot inspect the actual data transmitted. Firewall can probably do some
sort of heuristics based on packet sizes, but this will not be reliable
enough to distinguish TURN over TLS from HTTPS (or real time media over
HTTPS). In any case, if people are persistent enough they will find the way
to block RTC connections regardless of the protocol used.
_____________
Roman Shpount