Subject: [sipcore] Happy Eyeballs and UDP

From: Roman Shpount <[email-masked]>
Date: Thu, 3 Mar 2016 15:28:59 -0500

Since everyone is talking about how desirable TLS is and how easy it is to
deprecate UDP, can anybody point me to large scale implementations of
TLS+Outbound? I know a lot of implementations for UDP which handle 1M+ of
concurrent registrations. When someone tries to implement the same using
TLS and Outbound it much harder:

1. Maintaining large number of TLS connections is resource intensive. If
you have 1M concurrent registrations you need edge proxies which will
terminate 1M concurrent TLS connections and respond to keep alive messages.
This requires 10x number the servers then UDP registrations. This also
exposes you to more risk of DOS attacks

2. Fail-over is much harder: For TLS/Outbound you either need to put edge
proxy on VM that you can migrate to a different server (still had to deal
with software failure). To deal with software failures, you need to design
the mechanism for the client to recover the connection to a different edge
proxy. If call is in progress this involves for the client detecting the
flow failure based on keep alive failure, re-registering to get the gruu,
and re-INVITE with new gruu in the contact. If server needs to send a
message on the client call while this is happening, it needs to queue this
message or implement some sort of non-standard re-transmit timer. This
typically means call gets dropped. There is no mechanism at all to recover
the transaction which is in progress while outbound proxy fails. For UDP
you can move the IP address for the edge proxy to a different server. If
registration and flow state is in some sort of shared DB, the fail-over
occurs naturally for both the client and server.

I went through couple of large scale deployments of Outbound with SIPS for
large number of consumer devices. In all of them SIP registrations were
scrapped and replaced with something proprietary.

So, if we are talking about SIP for server to server communications, SIPS
is great but it does not need Happy Eyeballs since everything can be
provisioned in advance.

If we are dealing with deployments that deal with large end user devices
(which is where you need Happy Eyeballs) then a lot of things need to be
fixed in SIP Outbound before UDP can be discarded.

Regards,
_____________
Roman Shpount

---

From: Paul Kyzivat <[email-masked]>
Date: Thu, 3 Mar 2016 17:11:53 -0500

On 3/3/16 3:28 PM, Roman Shpount wrote:
> Since everyone is talking about how desirable TLS is and how easy it is
> to deprecate UDP, can anybody point me to large scale implementations of
> TLS+Outbound? I know a lot of implementations for UDP which handle 1M+
> of concurrent registrations. When someone tries to implement the same
> using TLS and Outbound it much harder:
>
> terminate 1M concurrent TLS connections and respond to keep alive
> messages. This requires 10x number the servers then UDP registrations.
> This also exposes you to more risk of DOS attacks
>
> 2. Fail-over is much harder: For TLS/Outbound you either need to put
> edge proxy on VM that you can migrate to a different server (still had
> to deal with software failure). To deal with software failures, you need
> to design the mechanism for the client to recover the connection to a
> different edge proxy. If call is in progress this involves for the
> client detecting the flow failure based on keep alive failure,
> re-registering to get the gruu, and re-INVITE with new gruu in the
> contact. If server needs to send a message on the client call while this
> is happening, it needs to queue this message or implement some sort of
> non-standard re-transmit timer. This typically means call gets dropped.
> There is no mechanism at all to recover the transaction which is in
> progress while outbound proxy fails. For UDP you can move the IP address
> for the edge proxy to a different server. If registration and flow state
> is in some sort of shared DB, the fail-over occurs naturally for both
> the client and server.

Isn't that the point of multiple flows in outbound?
(Of course that multiplies the number of registrations and TLS connections.)

> I went through couple of large scale deployments of Outbound with SIPS
> for large number of consumer devices. In all of them SIP registrations
> were scrapped and replaced with something proprietary.
>
> So, if we are talking about SIP for server to server communications,
> SIPS is great but it does not need Happy Eyeballs since everything can
> be provisioned in advance.

If we assume every end device has an outbound proxy, does that mean you 
are saying there is no problem for SIP Happy Eyeballs to solve?

> fixed in SIP Outbound before UDP can be discarded.

What do you mean by "large end user devices"? Do you mean enterprise SIP 
servers, such as for IVR or call center? Or enterprise SIP PBXs?

	Thanks,
	Paul