Subject: RTSP - UDP and firewalls

From: Jeff Smith <[email-masked]>
Date: Wed, 16 Oct 1996 12:16:55 -0700

Just thinking about things a bit...

You are assuming that RTSP can be used with multicast and you make
the case the RTSP is TCP-based for the purpose of firewalls, is this not
contradictory?

js

---

From: Adrien de Croy <[email-masked]>
Date: Thu, 17 Oct 1996 18:39:58 +1300

>the case the RTSP is TCP-based for the purpose of firewalls, is this not

My 2c worth on this.

For firewalls, it becomes very difficult to implement a proxy for a protocol
where the protocol is not based on TCP or does not have a TCP component.
This is because the proxy must allocate resources for a client request, and
with UDP you get no information about when a request is completed (i.e close
on a socket in TCP), and hence you have a problem about when to deallocate
the resource - you can't tell when someone has finished unless you analyse
the protocol to the nth degree, and the protocol includes a sign-off process.

You can do things like UDP relaying, but this has to rely on things like an
inactivity timeout in order to deallocate resources, which is inefficient at
best, and can cause problems with high volume sites (I have seen them - real
easy to run out of sockets if you are even a couple of seconds out in your
estimate of when to terminate a client session).

It is however very easy to create a proxy for a protocol that contains a
mixture of protocols (i.e TCP and UDP).  You can use the TCP connection to
decide when to deallocate resources (i.e when the TCP connection closes,
shut down the UDP sockets as well).

Adrien
-------------------------------------------------------------------------------
Adrien de Croy - [email-masked].  Qbik Software Limited, Auckland, New Zealand
                 See our pages and learn about WinGate at http://www.qbik.com/
-------------------------------------------------------------------------------

---

From: Bernard Aboba <[email-masked]>
Date: Thu, 17 Oct 1996 08:04:49 -0700

>If you are ultimately going to use UDP for multicast what is the value in TCP
>for setup?

Assuming you're proxying RTSP over TCP, then you can use the information 
arising from the setup to decide what ports to open for the return RTP over UDP
multicast stream. When the control port closes, the firewall hole closes as well. 

Of course, it's also possible to use SIP/SAP/SDP to do some of the same kinds of 
things, opening firewall holes for announced sessions or invited parties, and closing
them when the session expires.