Subject: Re: [sipcore] Happy Eyeballs -- UDP and RTT

From: Adam Roach <[email-masked]>
Date: Fri, 20 May 2016 17:29:52 -0500

On 3/2/16 14:31, Dale R. Worley wrote:
> Using TLS in a new connection adds a further RTT to TCP transmission times.

As an aside, as long as the data isn't sensitive to replay attacks, TLS 
1.3's 0-RTT data may help us here (assuming the host has been contacted 
before, which will be true most of the time in most SIP deployments). 
I'd have to double-check the status and properties of 0-RTT data to be 
sure that it's suitable, but I suspect it is. The point is that we may 
be finding relief here: by combining fast open and 0-RTT, I think we can 
get TCP/TLS SIP messages to the first hop as quickly as we can with UDP.

/a

---

From: Roman Shpount <[email-masked]>
Date: Fri, 20 May 2016 19:52:06 -0400

On Fri, May 20, 2016 at 6:29 PM, Adam Roach <[email-masked]> wrote:

> before, which will be true most of the time in most SIP deployments). I'd
> have to double-check the status and properties of 0-RTT data to be sure
> that it's suitable, but I suspect it is. The point is that we may be
> finding relief here: by combining fast open and 0-RTT, I think we can get
> TCP/TLS SIP messages to the first hop as quickly as we can with UDP.

There is still a big architectural difference between UDP and TLS based
call flows. For TLS (TCP) based call flow, the flow needs to be established
by the client for any client behind NAT. If Edge Proxy fails, new Edge
Proxy cannot easily recover the flow, even if it takes over the IP address.
Client needs to detect the flow failure using keep alive and then
re-establish flow to a new Edge Proxy. With default keep alive timers for
TLS, average failure detection time is 60 seconds. Which means server
originated transactions, such as SIP Session timers will have a high chance
of timing out and call failing.

With UDP, new Edge Proxy, if it recovers IP address, it can immediately
send SIP messages to the client behind NAT. Most of the times Edge Proxy
can be designed to be completely stateless, with all the information
necessary to forward the message stored in Route headers, so proxy fail
over implementation is trivial.

Finally, with current SIPS design, keep alive are sent over an encrypted
channel, which is a waste of resources and created an unnecessary load on
the Edge Proxies.

Regards,
_____________
Roman Shpount