Host B Host A Host B FIGURE 12.1 Generic NAT behavior. C 2009 by Taylor & Francis Group, LLC NAT Traversal Host B Host C NAT A Internal network Host A FIGURE 12.2 Host establishing sessions across NAT. packets to the other host involved in the session, if the hosts are communi- cating using UDP. This is typically obtained by exchanging keepalive dummy packets between hosts. RFC 4787 states that each binding must stay active without packets traversing the NATs for at least two minutes. However, for specific destination ports in the well-known range, this value may be lower. A suggested default value for the UDP binding timeout is five minutes. Static bindings, to be manually configured by the network administrator, might also be supported. 12.2.3 Filtering Behavior When an application running on an internal host opens a session through a NAT and is assigned an external transport address, the fact that any other host can send packets to the application by using the external transport address assigned by the NAT depends on the filtering behavior of the NAT. There are three possible filtering behaviors: Endpoint independent filtering behavior: as soon as the NAT binds an external transport address (A1:a1) to an internal transport address (A:a), the NAT forwards all the packets targeted to (A:a), independently from the transport address of the sender. This means that any application running on any external host can communicate with the internal one. Address-dependent filtering behavior: if an application running on a host behind a NAT using an internal transport address (A:a) has been bound to an external transport address (A1:a1) by the NAT, the NAT will filter out all the packets not targeted to (A:a). In addition, packets sent to C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security (A:a) by an external host will be filtered out if (A:a) has not sent packets to the network address of the sender before (independently of the port where the external sender received the packets). Addr