RE: Some extensions to STUN.

> One is testing to see if they rewrite data inside the payload of a UDP
> packet. NATs have been observed that rewrite the mapped address inside the
> stun packet. Multiple people have suggested a solution to this - an
> extension that returned an encrypted (mostly likely with xor) form of the
> the mapped address with some predefined key would detect this.

We did observe that behavior in some NATs during the testing of Teredo, and incorporated an XOR protection in Teredo. I suggested to incorporate the same fix in STUN, but I was overruled by my co-authors.
 
-- Christian Huitema