比較與分析NAT穿透技術ICE在UDP和TCP上的差異

Abstract

Network Address Translation (NAT) 的出現破壞了以往peer-to-peer (P2P) 的連線模式，使得無論UDP還是TCP在P2P連線上出現了許多問題，因此如何穿越NAT的方法逐漸被重視。再加上NAT處理UDP與TCP的connection行為不同與UDP和TCP本身的差異(即UDP為非連接傳輸模式而TCP是非對稱的連線)，因此在UDP及TCP上各自擁有不同的solution來解決穿越NAT的問題。雖然目前有STUN、STUNT、P2PNAT和TURN等穿透NAT方法被提出來，但因為這些技術是各別使用而無法一一針對不同的NAT行為來解決所有問題，因此Interactive Connectivity Establishment (ICE)提供一套機制將這些技術整合運用，並透過路徑檢查的機制來探測所有整合技術可穿透NAT的路徑。在這□我們提一個實驗用來測量ICE在UDP/TCP上的直連率以及分析其實作在socket layer以及直連路徑測試程序上的不同以及他們的穿透能力。最後我們發現目前ICE-UDP和ICE-TCP穿透能力已經達到DCR目前所能達成的上限, 並且建議NAT廠商們如何改善NAT行為來增加目前軟體所及的DCR 上限.

The appearance of Network Address Translation (NAT) breaks the common peer-to-peer (P2P) communication model and causes difficulties for UDP/TCP P2P communications. For this reason, the NAT traversal problem is important. NAT has the distinct behavior to handle UDP and TCP connections. In addition, the UDP and TCP protocol have their own characteristics. For example, UDP is connectionless while TCP is connection-oriented. Therefore, various solutions on UDP and on TCP are proposed, respectively. Several traversal techniques such as STUN, STUNT, P2PNAT, and TURN are proposed and individually utilized but they cannot traverse all NATs because of various NAT behavior. Interactive Connectivity Establishment (ICE) provides a mechanism to integrate these techniques to traverse a NAT via connectivity check which tests and verifies all traversable paths. Here we design an experiment to measure the direct connection ratio (DCR) and analyze the main differences between ICE-UDP and ICE-TCP such as the implementation of socket layer and the procedure of connectivity check and NAT traversal ability. Finally, we find out the DCR of ICE-UDP and ICE-TCP has reached the upper-bound, and propose that the NAT venders should reform NAT to increase the room of DCR upper-bound for applications.