4

I'm trying to identify teredo packets on a network, and I'm getting conflicting information on whether or not the Teredo relay machine, which sends the actual ipv6 encapsulated traffic, listens on port 3544.

The RFC4380 doesn't seem to have any concrete information on if the teredo relay machine listens on a specific port.

However this paper by symantec, says that the relay can use any udp port

"The standard port on which the Teredo servers listen is UDP port 3544. Both clients and relays can use any UDP port for their Teredo service, so their UDP service port could be ephemeral."

From here on page 9, https://www.symantec.com/avcenter/reference/Teredo_Security.pdf.

And later says that to properly identify teredo packets, I would have to attempt to parse all udp packets as teredo to be sure.

However, on Microsoft's website on teredo, https://msdn.microsoft.com/en-us/library/windows/desktop/bb968770(v=vs.85).aspx It says that the Teredo Relay listens on port 3544.

If that's the case, then I could just attempt to parse packets with port 3544 as teredo, and that would be much less processing.

So, what is the case? Thank you.

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 15 '17 at 1:12
1

The thing you have to understand about Teredo is it's NOT a traditional client-server protocol. It's a NAT traversal based protocol. Relays have more in common with clients than they do with servers.

Servers have to have an address and port on the IPv4 internet that is at least reasonablly stable since it will be included in client configuration. Using a well-known port makes configuring clients easier.

Clients and relays on the other hand may be behind IPv4 NATs. It is best if a client or relay uses a random port due to the existance of "port-preservative" NATs.

I do not know if that help page is simply wrong or if MS made the boneheaded descision to make their teredo relays use a fixed port. Even if they did you can't rely on all teredo traffic using that port. Some teredo traffic will go directly between two clients without every hitting a relay. Some relays will be behind NATs. Many relays will not be running MS implementations.

If you want to reliablly monitor teredo traffic I see two options.

  1. Inspect every UDP packet for signs of teredo.
  2. Monitor for connections to teredo servers (which most likely will use the well-known port) and save the local ports. You can then monitor those local ports for teredo data traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.