Andrew Cooke | Contents | Latest | RSS | Twitter | Previous | Next

C[omp]ute

Welcome to my blog, which was once a mailing list of the same name and is still generated by mail. Please reply via the "comment" links.

Always interested in offers/projects/new ideas. Eclectic experience in fields like: numerical computing; Python web; Java enterprise; functional languages; GPGPU; SQL databases; etc. Based in Santiago, Chile; telecommute worldwide. CV; email.

Personal Projects

Lepl parser for Python.

Colorless Green.

Photography around Santiago.

SVG experiment.

Professional Portfolio

Calibration of seismometers.

Data access via web services.

Cache rewrite.

Extending OpenSSH.

C-ORM: docs, API.

Last 100 entries

[Link, Future] Simulated Brain Drives Robot; [Link, Computing] Learned Index Structures; Solo Air Equalization; Update: Higher Pressures; Psychology; [Bike] Exercise And Fuel; Continental Race King 2.2; Removing Lowers; Mnesiacs; [Maths, Link] Dividing By Zero; [Book, Review] Ray Monk - Ludwig Wittgenstein: The Duty Of Genius; [Link, Bike, Computing] Evolving Lacing Patterns; [Jam] Strawberry and Orange Jam; [Chile, Privacy] Biometric Check During Mail Delivery; [Link, Chile, Spanish] Article on the Chilean Drought; [Bike] Extended Gear Ratios, Shimano XT M8000 (24/36 Chainring); [Link, Politics, USA] The Future Of American Democracy; Mass Hysteria; [Review, Books, Links] Kazuo Ishiguro - Never Let Me Go; [Link, Books] David Mitchell's Favourite Japanese Fiction; [Link, Bike] Rear Suspension Geometry; [Link, Cycling, Art] Strava Artwork; [Link, Computing] Useful gcc flags; [Link] Voynich Manuscript Decoded; [Bike] Notes on Servicing Suspension Forks; [Links, Computing] Snap, Flatpack, Appimage; [Link, Computing] Oracle is leaving Java (to die); [Link, Politics] Cubans + Ultrasonics; [Book, Link] Laurent Binet; VirtualBox; [Book, Link] No One's Ways; [Link] The Biggest Problem For Cyclists Is Bad Driving; [Computing] Doxygen, Sphinx, Breathe; [Admin] Brokw Recent Permalinks; [Bike, Chile] Buying Bearings in Santiago; [Computing, Opensuse] Upgrading to 42.3; [Link, Physics] First Support for a Physics Theory of Life; [Link, Bike] Peruvian Frame Maker; [Link] Awesome Game Theory Tit-For-Tat Thing; [Food, Review] La Fabbrica - Good Italian Food In Santiago; [Link, Programming] MySQL UTF8 Broken; [Link, Books] Latin American Authors; [Link, Computing] Optimizatin Puzzle; [Link, Books, Politics] Orwell Prize; [Link] What the Hell Is Happening With Qatar?; [Link] Deep Learning + Virtual Tensor Machines; [Link] Scaled Composites: Largest Wingspan Ever; [Link] SCP Foundation; [Bike] Lessons From 2 Leading 2 Trailing; [Link] Veg Restaurants in Santiago; [Link] List of Contemporary Latin American Authors; [Bike] FTHR; [Link] Whoa - NSA Reduces Collection (of US Residents); [Link] Red Bull's Breitbart; [Link] Linux Threads; [Link] Punycode; [Link] Bull / Girl Statues on Wall Street; [Link] Beautiful Chair Video; Update: Lower Pressures; [Link] Neat Python Exceptions; [Link] Fix for Windows 10 to Avoid Ads; [Link] Attacks on ZRTP; [Link] UK Jazz Invasion; [Review] Cuba; [Link] Aricle on Gender Reversal of US Presidential Debate; {OpenSuse] Fix for Network Offline in Updater Applet; [Link] Parkinson's Related to Gut Flora; Farellones Bike Park; [Meta] Tags; Update: Second Ride; Schwalbe Thunder Burt 2.1 v Continental X-King 2.4; Mountain Biking in Santiago; Books on Ethics; Security Fail from Command Driven Interface; Everything Old is New Again; Interesting Take on Trump's Lies; Chutney v6; References on Entropy; Amusing "Alexa.." broadcast; The Shame of Chile's Education System; Playing mp4 gifs in Firefox on Opensuses Leap 42.2; Concurrency at Microsoft; Globalisation: Uk -> Chile; OpenSuse 42.2 and Synaptics Touch-Pads; Even; Cherry Jam; Lebanese Writer Amin Maalouf; C++ - it's the language of the future; Learning From Trump; Chinese Writer Hu Fayun; And; Apricot Jam; Also; Excellent Article on USA Politics; Oh Metafilter; Prejudice Against The Rurals; Also, Zizek; Trump; Why Trump Won; Doxygen + Latex on CentOS 6; SMASH - Solve 5 Biggest Problems in Physics

© 2006-2017 Andrew Cooke (site) / post authors (content).

What is TCP hole punching?

From: andrew cooke <andrew@...>

Date: Tue, 8 Feb 2011 07:19:15 -0300

It is common (largely because of the restricted number of IPV4 addresses) for
several computers to share the same "external" address.  This is done by NAT
(Network Address Translation) at the point where the internal network meets
the external network.

By default, NAT does not support "incoming" connections.  This is because
there is no simple way for a computer connecting from "outside" to identify a
particular internal computer (since all share the same external address).

The lack of incoming connections means that an application on a computer on an
internal network must initiate all network exchanges and, furthermore, can
only connect to a computer that does have an external address.  This is a
problem for peer-to-peer (P2P) systems, since it requires a separate, public
server to act as the target for connections.

The problem is made worse by the fact that the TCP specification does not
allow for a conversation to be "redirected" to a different machine.  When two
P2P peers have both connected to a central server there is no simple mechanism
for them to address each other directly; all traffic must continue to be
routed through the public server to which the initial connections were made.

This last point is the problem solved by TCP hole punching.  It is a mechanism
that allows two peers to converse directly, even when NAT is in use.

Because a variety of implementations are used, the details that follow are
only a rough sketch.  See the references posted by others for more details [I
am writing this answer not because I am an expert on this, but because I found
neither of the other answers to be very clear].

In general, hole punching requires the following:

- An external, public server that is the target for initial connections, 
  and which helps coordinate the connection process.  

- Two peers behind NAT, who will eventually be connected directly.

- NAT implementations that are lenient in the traffic that they accept, 
  and which are predictable in how they operate.  

- A protocol (like TCP) which is lenient in the traffic it accepts and 
  which, in particular, uses a state machine and messages that are more 
  symmetric than the server / client roles that are assumed at a higher 
  level.

The "leniency" I mention above is driven by the need for these components to
function reliably on unreliable networks and to support a wide variety of
traffic (it is not, typically, a result of poor implementation).

The general process (bearing in mind that this is only a rough sketch) for
hole punching is:

- Peers connect to a central, public server and agree on which pairs will
  connect.

- The central server identifies, for each NAT, how future outgoing connections
  are created (when a peer makes a connection that passes through the NAT then
  a port must be opened on on the NAT to receive the response; typically the
  port numbers used are sequential).

- Peers then open new connections, each aware of the external (NAT) address
  and likely port of the other peer.

By manipulating the TCP traffic (eg. by setting TTL values so that some
outgoing packets cannot reach the other peer) and/or by exploiting uncertainty
in timings and leniency in the NAT and TCP implementations, and by exploiting
symmetry in the underlying state machines and messages, it is then possible
for the two new connections, each of which was opened as client, to reach a
state as though they were opened in a normal client / server conversation.
Once the two peer connections are in the desired state no further use is made
of the public server; the peers can communicate directly with each other.

[From an old Quora answer]

Andrew

Comment on this post