RavnaryA Knowledge Platform
Colour theme

Card 06/ 10

Take the quiz

ExampleDifficulty: Advanced2 min

WebRTC Example: Two Laptops Behind Home Routers

Follow the candidates two laptops gather and the pair that finally connects them.

ICE, followed through one call between two laptops on separate home networks, shows which candidates each gathers, which pairs pass their checks and which pair is chosen; changing one router then shows when only TURN gets through. Addresses are from documentation ranges and the run is illustrative.

Laptop A gathers host 192.168.1.20, server-reflexive 203.0.113.5 from STUN, and relay 198.51.100.9 on the TURN server. Laptop B gathers host 10.0.0.15, server-reflexive 198.51.100.77, and relay 198.51.100.9 on a different port.

Candidate pairs checked between laptop A and laptop B

InputThree candidates on each side; both routers keep one public port per local port

  1. A host 192.168.1.20 to B host 10.0.0.15

    1. check sent
    2. no answerfailed

    Private addresses on different networks cannot reach each other.

  2. A reflexive 203.0.113.5 to B reflexive 198.51.100.77

    1. check sent
    2. answeredchosen

    Each router lets in replies to the checks its own laptop sent out.

  3. A relay to B relay, via 198.51.100.9

    1. check sent
    2. answeredbackup

    Works too, but a relay ranks below a direct pair.

ResultThe server-reflexive pair is chosen, and media flows directly between the two public addresses.

Why the direct pair worked. When laptop A sends a check to 198.51.100.77, its router records the outgoing packet, so a reply, or B's own check, from that address is let back in. B's router does the same. Because both routers kept the same public port that STUN reported, each side was sending to the right place. Change laptop B's router. Suppose it gives a new public port for every destination. STUN saw B on one port, but B's checks to A leave from another, so A's checks to the port STUN reported find nothing open. The reflexive pair fails, and the relay pair is chosen. Media now travels A to TURN to B, still encrypted, with an extra hop of delay.

Change the network instead. Put laptop A on a company network that blocks outgoing UDP. Every UDP check fails, and only a TURN server reachable over TCP or TLS on port 443 connects the call.

The lesson is that the same two laptops can connect directly or only through a relay, depending on two routers neither user can see.

← → move through sections and cards