 partially defined Request-URI can be sent using multicast. For example, a multicast INVITE could be sent to sip: @mci. com, which would invite all MCI employees with SIP phones receiving the request to respond. Responses to a multicast request are also sent by multicast. To limit congestion, only a limited set of responses is allowed by the standard. A proxy can forward a unicast INVITE request to a multicast address. The use of multicast is recorded in a SIP message using the maddr parameter in the Via header field, as discussed in Section 6.1.14. However, due to the limited implementations of multicast, these features are rarely used. SIP Clients and Servers Firewalls and NAT Interaction Most corporate LANs or intranets connect to the public Internet through a fire- wall. A firewall is filtering software usually in a router or hub that is used to pro- tect the LAN behind it from various kinds of attacks and unauthorized access. Firewalls are also increasingly being used in home network routers and wireless hubs and in PCs themselves. Sometimes they are used to prevent users behind the firewall accessing certain resources in the Internet. In the simplest deploy- ment, a firewall can be thought of as a one-way gate: It allows outgoing packets from the intranet to the Internet, but blocks incoming packets from the Internet unless they are responses to queries. Only certain types of requests from the Internet will be allowed to pass through the firewall, such as HTTP requests to the corporate Web server, SMTP e-mail messages, or DNS queries to the authoritative DNS for the corporate domain. The firewall does this by keeping track of TCP connections opened and filtering ports. Firewalls pose a particularly difficult challenge to SIP sessions. Because SIP can use TCP and a well-known port, configuring a firewall to pass SIP is not too difficult. This does not help the media path, however, which uses RTP over UDP on various ports and will be blocked by most firewalls. A firewall or a proxy that controls the firewall 