needs to understand SIP, be able to parse an INVITE request and 200 OK response, extract the IP addresses and port num- bers from the SDP, and open up "pin holes" in the firewall to allow this traffic to pass. The hole can then be closed when a BYE is sent or a session timer expires. An alternative is an ALG-a B2BUA that is trusted by the firewall. The firewall then allows SIP and RTP traffic, which terminates on the ALG and blocks all other traffic. The authentication and security policies of allowing or denying SIP sessions are then controlled by the SIP ALG instead of in the fire- wall itself. Network address translators (NATs) also cause serious problems for SIP. A NAT can be used to conserve IPv4 addresses, or can be used to hide the IP address and LAN structure behind the NAT. It is used on a router or firewall that provides the only connection of a LAN to the Internet, a so-called stub net- work. A NAT allows nonunique IP addresses to be used internally within the LAN. When a packet is sent from the LAN to the Internet, the NAT changes the nonglobally unique address (usually addresses in the range 10 X. 172.16.x.x - 172. 29 X. and 192.168.x.x) in the packet header to a globally unique address from a pool of available addresses. Addresses can also be statically assigned. This means that every node on the network does not have to have a globally unique IP address. Responses from the Internet are trans- lated back to the nonunique address. A NAT, however, is not completely trans- parent to higher layers. For a signaling protocol such as SIP, a NAT can cause particular problems. SIP: Understanding the Session Initiation Protocol Because responses in SIP are routed using Via header fields, a device behind a NAT will stamp its nonroutable private IP address in its Via header field of messages that it originates. When the request is forwarded outside the intranet by the NAT, the UDP and IP packet headers will be rewritten with a temporarily assigned global Internet address. The NAT will keep track of the binding 