draft-ietf-behave-nat-behavior-discovery-01 Derek MacDonald Bruce Lowekamp

Changes from IETF-68 Clarified that only stun servers with two IP addresses should use SRV entry Removed backward compatibility with 3489 clients (SHOULD NOT) PADDING mandatory Use MAPPED-ADDRESS to detect generic ALG

Feedback from List Non-normative Detecting linux NATs hairpinning parallelization Detecting linux NATs slippery slope timing sensitive action: include mention of timing sensitivity action: examples of detecting specific NATs out of scope

Intended Status Current draft is PS. Given that we are all concerned about potential uses of these techniques, there may be concerns about this draft. BUT, there are legitimate uses of these techniques, and it is very important to document what they can and can’t do. Applications might be able to use it legitimately. Question: Change to experimental?

Open Issue: 3489bis-07 Needs revisions mostly straightforward can be SRV or pre-provisioned backward compatibility not required update IAB and Security considerations

Open Issue: Cache-Timeout Response code 430 originally proposed for when server has lost state/secret allowing it to honor RESPONSE-ADDRESS Propose new error code to indicate must redo original Binding Request with CACHE-TIMEOUT Options: 412 Conditional Request Failed something new?

Open Issue: Shared Secret Currently says MUST use shared secret for RESPONSE-ADDRESS. No longer a clear way of acquiring secret. Proposal: change to SHOULD use authentication servers MUST rate-limit if not authenticating

Open Issue: Compatibility Previous conclusion was that 3489bis clients would ignore OTHER-ADDRESS and SOURCE-ADDRESS Backward compatibility now dropped. Options Request tag, change 3489bis, make responses optional, different ports. Proposal: Make OTHER-ADDRESS and SOURCE-ADDRESS optional, change names