TWI506998B - Traversal method for icmp-sensitive nat - Google Patents

Description

ICMP sensitive NAT traversal method

The present invention relates to a NAT (Network Address Translator) traversal method, and more particularly to a traversal method for NAT with ICMP (Internet Control Message Protocol) sensitivity, which uses synchronization technology to achieve traversal.

In the current SIP (Session Initiation Protocol) network environment, it is very common to set up a Network Address Translator (NAT) server. However, a network phone under the NAT server cannot directly transmit a voice packet (Peer to Peer). Through the SIP proxy server.

In order for the voicephone to directly transmit the voice packet, it must try to traverse the NAT server. There are many related inventions. For example, the Republic of China invention patent I 376133 is a registration procedure that is repeated several times before an Invite message is issued during the computer registration phase to detect the change of the protocol of the NAT server. The subsequent voice packet is This regular change predicts the communication that should be assigned and directly transmits it without having to go through the SIP proxy server.

However, the above-mentioned traversal method fails to encounter the ICMP (Internet Control Message Protocol)-sensitive NAT. The description is as follows: See Figure 1 for the direct transmission of voice packets in the SIP (Session Initiation Protocol) network environment. The road telephone 1 and the network telephone 2 are respectively under the symmetric NAT3 and the symmetric NAT4. The voice packet contains four parameters, namely the source IP address, the source communication port number, the destination IP address, and the destination communication number. Internet phone 1 sends voice packet-1 to network phone 2. When symmetric NAT3, voice packet-1 becomes voice packet-1 ' , and source IP address VIP1 in voice packet-1 is changed to RIP1, source communication The 埠 number SP1 is changed to SP1 ' , and the destination IP address RIP2 and the destination communication number DP1 remain unchanged. Similarly, the network phone 2 sends a voice packet-2 to the network phone 1. When the symmetric NAT4 passes, the voice packet-2 becomes the voice packet-2 ' , and the source IP address VIP2 in the voice packet-2 is changed to the RIP2. The source communication port number SP2 is changed to SP2 ' , and the destination IP address RIP1 and the destination communication port number DP2 remain unchanged.

If the voice packets of both parties are to be delivered to the other party, it must be: SP1 ' =DP2 and DP1=SP2 ' . SP1 ' is specified by symmetric NAT3, SP2 ' is specified by symmetric NAT4, and the NAT server specifies or allocates the communication 埠 to change according to the law. By using the Republic of China invention patent I 376133 to issue an Invite message during the computer registration phase, multiple registration procedures can be used to detect changes in the distribution of communication messages by the NAT server. The subsequent voice packets are changed by this law. The communication that should be assigned is predicted to be directly transmitted. But even if it is directly transmitted, the two sides will not be able to fully synchronize the pass.

If symmetric NAT3 and symmetric NAT4 are ICMP (Internet Control Message Protocol) sensitive NAT (that is, defensive for hackers or viruses), when both voice packets are not completely synchronized, a blocked communication will occur. Case. Please refer to FIG. 2, the voice packet-1 of the network telephone 1 is converted into a voice packet -1 ' transformed into a symmetric NAT4 by symmetric NAT3. At this time, if the voice packets of both parties are not completely synchronized, the communication of the symmetric NAT4 has not yet been communicated. Open, symmetric NAT4 will generate defensive actions, return an ICMP reject packet to symmetric NAT3, symmetric NAT3 thus self-block communication (as indicated by the number ◆), when the network phone 2 sends a voice packet-2 When symmetric NAT4 is converted into voice packet-2 ' when it is sent to symmetric NAT3, it is blocked by symmetric NAT3. This is called outbound.

Another case where voice packets see Figure 3, an Internet telephone via the symmetrical NAT3 -1 converted into voice packets 1 'into symmetrical NAT 4, at this time if the two sides of the voice packets are not fully synchronized transmission, the symmetric NAT 4 The communication port is not yet open, the symmetric NAT4 will generate defensive actions, and send an ICMP reject packet to the symmetric NAT3. The symmetric NAT4 also self-blocks the communication port (as shown by the ◆), when the network phone B sends a voice. When packet-2 passes through symmetric NAT4, it is blocked by symmetric NAT4. This is called inbound.

In order to solve the problem that the ICMP-sensitive NAT encounters that the voice packets of the two parties are not completely synchronized, the communication is blocked. The present invention adds a synchronization phase to the SIP protocol to solve the problem of traversal.

The invention divides the SIP communication protocol into a registration phase, a communication, a prediction phase, a synchronization phase and a media phase, and the network environment is composed of a first network phone, a second network phone, a first symmetric NAT, and a second The symmetric NAT is composed of a SIP proxy server, a first network phone is under the first symmetric NAT, a second network phone is under the second symmetric NAT, the first symmetric NAT and the second symmetric Type NAT has ICMP sensitivity. The traversal method includes: the first network phone and the second network phone first register with the SIP proxy server to complete the registration phase; the first network phone makes multiple times to the first symmetric NAT. (N times) detection procedure to detect the regular change of the first symmetric NAT distribution communication protocol; the second network telephone makes multiple (N times) detection procedures to the second symmetric NAT to detect the second The regularity of symmetric NAT distribution communication After completing the communication/predicting phase; after entering the synchronization phase, the first network phone sends a test packet to the SIP proxy server via the T1 time, and the SIP proxy server returns the packet to the first network phone, after T2. Time; (T1+T2) divided by 2 is the average time T3 that the first network phone sends the packet to the SIP proxy server, after which the first network phone sends a packet containing the time information T3 to the SIP proxy server. The SIP proxy server retains; in the same manner, the second network phone sends a test packet to the SIP proxy server via the T4 time, and the SIP proxy server returns the packet to the second network phone for T5 time; (T4+T5) divided by 2 is the average time T6 when the second network phone sends the packet to the SIP proxy server. At this time, the second network phone sends a packet containing the time information T6 to the SIP proxy server. The SIP proxy server retains; after the SIP proxy server receives the packets containing the time information, the packets containing the time information are simultaneously exchanged and transmitted to the other party, and the first network phone will receive the second packet. The road phone sends the packet containing the time information T6 and obtains T6; and the second network phone receives the packet containing the time information T3 sent by the first network phone, and obtains T3; if T6>T3, then the second After receiving the packet, the network phone can directly enter the media stage, and directly send the voice packet to the first network phone without the SIP proxy server; the first network phone must wait for the T6-T3 time after receiving the packet. Only then can enter the media stage directly, without sending a voice packet to the second network phone without the SIP proxy server, after which the two parties enter the media phase and directly synchronize the voice packets; if T3>T6, the first network phone After receiving the packet, it can directly enter the media stage, and directly send the voice packet to the second network phone without the SIP proxy server; the second network After receiving the packet, the phone still has to wait for T3-T6 time before entering the media stage directly, and directly sends the voice packet to the first network phone without the SIP proxy server. After that, the two parties enter the media phase and directly synchronize the voice transmission. Packet.

1‧‧‧Internet phone

2‧‧‧Internet phone

3‧‧‧Symmetric NAT

4‧‧‧Symmetric NAT

5‧‧‧SIP proxy server

FIG. 1 is a schematic diagram of voice packet transmission in a SIP network environment.

Figure 2 is a schematic diagram of the outbound.

Figure 3 is a schematic diagram of an inbound.

Figure 4 is a schematic diagram of the registration phase and communication prediction phase.

Figure 5 is a schematic diagram of the synchronization phase and the media phase.

The present invention divides the SIP network environment into four phases, namely, a Login Session, a Port Prediction Session, a Synchronization Session, and a Media Session.

Please refer to Figure 4 for the registration phase and communication forecasting phase. Figure 5 continues with Figure 4, showing the synchronization phase and the media phase.

In FIG. 4, the network telephone 1 and the network telephone 2 first register with the SIP proxy server 5 to complete the registration phase.

Then enter the communication 埠 prediction phase, the VoIP phone 1 uses the Register command to make multiple (N times) detection procedures to detect the regular change of the symmetric NAT3 distribution communication 埠. After completing the N detection procedure, when the voice packet is transmitted by the network telephone 1, the regular change of the communication port is allocated according to the symmetric NAT3, and the communication port number to be assigned by the symmetric NAT3 is predicted to be used as the transmission voice. The pipe of the packet.

The VoIP 1 then sends a New Invite message to the SIP Proxy Server 5 via symmetric NAT3, and the SIP Proxy Server 5 sends a New Invite-1 message to the VoIP 2 via the symmetric NAT4.

After receiving the New Invite-1 message, the VoIP phone 2 uses the Register command to perform multiple (N times) detection procedures to detect the regular change of the symmetrical NAT4 distribution communication port. After the N detection process is completed, the network phone 2 transmits the voice packet according to the regular change of the communication port of the symmetric NAT4, and predicts the communication port number to be allocated by the symmetric NAT4 as the transmission voice. The pipe of the packet. This completes the communication/predictive phase. The method of communication prediction stage is not limited to this method, and this method is only an example.

See Figure 5 for the synchronization phase and media phase. The network phone 1 first sends a test packet to the SIP proxy server 5 via the T1 time, and the SIP proxy server 5 transmits the packet back to the network phone 1, after T2. (T1+T2) divided by 2 is the average time T3 when the VoIP phone 1 sends the packet to the SIP proxy server 5. At this time, the VoIP phone 1 sends a packet containing the time information T3 to the SIP proxy server 5, by The SIP proxy server 5 is retained.

Similarly, the network phone 2 first sends a test packet to the SIP proxy server 5 via the T4 time, and the SIP proxy server 5 transmits the packet back to the network phone 2 for T5. (T4+T5) divided by 2 is the average time T6 when the VoIP phone 2 sends the packet to the SIP proxy server 5, at this time, the VoIP phone 2 sends a packet containing the time information T6 to the SIP proxy server 5, by The SIP proxy server 5 is retained.

After receiving the packet with time information on both sides, the SIP proxy server then exchanges the packets containing the time information to the other party at the same time, and the network phone 1 will receive the packet containing the time information T6 sent by the network phone 2. And get T6; while VoIP 2 will receive the net The road telephone 1 transmits a packet containing time information T3 and acquires T3.

If T6>T3, the network phone 2 can directly enter the media stage after receiving the packet, and directly send the voice packet to the network phone 1 without the SIP proxy server 5. After receiving the packet, the VoIP phone 1 has to wait for the T6-T3 time to enter the media phase directly, and directly sends the voice packet to the VoIP phone 2 without the SIP proxy server 5. After that, the two parties entered the media stage and directly synchronized the voice packets.

If T3>T6, the network phone 1 can directly enter the media stage after receiving the packet, and directly send the voice packet to the network phone 2 without the SIP proxy server 5. After receiving the packet, the VoIP phone 2 has to wait for the T3-T6 time to enter the media phase directly, and directly sends the voice packet to the VoIP phone 1 without the SIP proxy server 5. After that, the two parties entered the media stage and directly synchronized the voice packets.

The spirit and scope of the present invention are determined by the scope of the following claims, and are not limited to the above embodiments.

1‧‧‧Internet phone

2‧‧‧Internet phone

3‧‧‧Symmetric NAT

4‧‧‧Symmetric NAT

5‧‧‧SIP proxy server

Claims (1)

An ICMP-sensitive NAT traversal method divides a SIP communication protocol into a registration phase, a communication, a prediction phase, a synchronization phase, and a media phase, and the network environment is composed of a first network phone, a second network phone, and a first network phone. A symmetric NAT, a second symmetric NAT and a SIP proxy server, a first network phone is under the first symmetric NAT, and a second network phone is under the second symmetric NAT. A symmetric NAT and a second symmetric NAT both have ICMP sensitivity, and the traversal method includes: a. The first network phone and the second network phone first register with the SIP proxy server to complete the registration phase; b. The network phone makes multiple (N times) detection procedures to the first symmetric NAT to detect the regular change of the first symmetric NAT distribution communication; the second network telephone makes multiple times to the second symmetric NAT ( N times) detection procedure to detect the change of the second symmetric NAT distribution communication protocol, complete the communication埠 prediction phase; c. After entering the synchronization phase, the first network phone sends a test packet to reach the SIP through the T1 time. Proxy server, SIP proxy server returns the packet to the first An Internet phone, after T2 time; (T1+T2) divided by 2 is the average time T3 of the first network phone to send the packet to the SIP proxy server, after which the first network phone sends a message containing time information T3. The packet arrives at the SIP proxy server and is retained by the SIP proxy server; d. Similarly, the second network phone sends a test packet to the SIP proxy server via the T4 time, and the SIP proxy server returns the packet to the first Two network calls, after T5 time; (T4 + T5) divided by 2 is the second network phone to send packets to the SIP proxy The average time of the server is T6. At this time, the second network phone sends a packet containing the time information T6 to the SIP proxy server, which is retained by the SIP proxy server; e. The SIP proxy server receives the time information of both parties. After the packet, the packet containing the time information is simultaneously exchanged and transmitted to the other party, and the first network phone will receive the packet containing the time information T6 sent by the second network phone, and obtain the T6; The road phone will receive the packet containing the time information T3 sent by the first network phone, and obtain T3; f. If T6>T3, the second network phone can directly enter the media stage after receiving the packet, The SIP proxy server directly sends the voice packet to the first network phone; after receiving the packet, the first network phone has to wait for the T6-T3 time before entering the media phase directly, without the SIP proxy server, directly Sending a voice packet to the second network phone, after which the two parties enter the media phase and directly synchronize the voice packets to each other; g. If T3>T6, the first network phone can directly enter the media stage after receiving the packet, without SIP proxy The server directly sends the voice packet to the second network phone; after receiving the packet, the second network phone has to wait for the T3-T6 time before entering the media phase directly, and directly sending the voice packet without the SIP proxy server. The first network phone is sent, and then both parties enter the media stage to directly synchronize the voice packets.