GLOSSARY · SESSION TRAVERSAL UTILITIES FOR NAT
STUN
STUN is a simple protocol where a device asks a public server, "what address and port do you see me coming from?" The server replies with the answer. It is defined in RFC 8489 and normally uses port 3478.
Why it matters
Devices behind NAT only know their private address. STUN lets them learn the public address and port that the outside world sees, so two devices can try to connect directly. This is the step that lets WebRTC leak a public address: the browser asks a STUN server, and the answer can reveal an address that bypasses your VPN.
In practice
Our WebRTC test uses public STUN servers, and it sees the same answers a website could. STUN only discovers addresses. When a direct connection cannot be formed, a relay called TURN carries the traffic instead. Seeing STUN requests in a network capture usually means a browser or app is preparing a real-time connection.
Related terms
- WebRTC: WebRTC is a set of browser features that lets web pages make direct audio, video and data connections between devices, without plug-ins.
- NAT: NAT is a technique where a router rewrites the addresses on outgoing traffic so that many devices with private addresses can share one public IP address.
- Public vs. private IP address: A public IP address is reachable across the internet and is the one websites see.
- Port: A port is a number from 0 to 65535 that tells a computer which program should receive incoming network data.