I'm trying to identify teredo packets on a network, and I'm getting conflicting information on whether or not the Teredo relay machine, which sends the actual ipv6 encapsulated traffic, listens on port 3544.
The RFC4380 doesn't seem to have any concrete information on if the teredo relay machine listens on a specific port.
However this paper by symantec, says that the relay can use any udp port
"The standard port on which the Teredo servers listen is UDP port 3544. Both clients and relays can use any UDP port for their Teredo service, so their UDP service port could be ephemeral."
From here on page 9, https://www.symantec.com/avcenter/reference/Teredo_Security.pdf.
And later says that to properly identify teredo packets, I would have to attempt to parse all udp packets as teredo to be sure.
However, on Microsoft's website on teredo, https://msdn.microsoft.com/en-us/library/windows/desktop/bb968770(v=vs.85).aspx It says that the Teredo Relay listens on port 3544.
If that's the case, then I could just attempt to parse packets with port 3544 as teredo, and that would be much less processing.
So, what is the case? Thank you.