How ICE Uses UDP for Peer-to-Peer Routing

Interactive Connectivity Establishment (ICE) is a standardized framework designed to establish direct peer-to-peer (P2P) connections across complex network topologies and NAT (Network Address Translation) firewalls. This article explains how ICE leverages User Datagram Protocol (UDP) to discover routing paths, perform NAT hole punching, validate reachability, and select the optimal low-latency route for real-time media and data transmission.

Why ICE Relies Primarily on UDP

Real-time communication protocols like WebRTC and SIP prioritize speed and minimal latency over guaranteed packet delivery. UDP is the transport layer protocol of choice for ICE because it is connectionless and has minimal overhead. Unlike TCP, UDP does not require a multi-step handshake to begin transmitting, avoids head-of-line blocking during packet loss, and facilitates the bidirectional NAT mapping (hole punching) essential for direct peer connections.

Candidate Gathering

The ICE process begins with candidate gathering, where each endpoint discovers all possible UDP transport addresses (IP address and UDP port pairs) it can use for communication:

1. Host Candidates: The device’s local network interfaces (e.g., local IP and a bound UDP port).
2. Server Reflexive Candidates (STUN): The device sends UDP-based Session Traversal Utilities for NAT (STUN) binding requests to an external STUN server. The server responds with the public IP and UDP port allocated by the NAT, revealing how the outside world sees the client.
3. Relay Candidates (TURN): If direct communication fails, Traversal Using Relays around NAT (TURN) servers allocate a public UDP relay address on behalf of the client to guarantee connectivity as a fallback.

SDP Exchange and Candidate Pairing

Once gathered, endpoints exchange their lists of UDP candidates via a signaling channel using Session Description Protocol (SDP). ICE then pairs the local UDP candidates with the remote UDP candidates, creating candidate pairs (e.g., Local Host UDP + Remote Host UDP, Local Reflexive UDP + Remote Reflexive UDP). These pairs are prioritized based on efficiency, with direct host-to-host UDP paths ranked highest and relayed TURN paths ranked lowest.

Connectivity Checks and UDP Hole Punching

ICE tests the candidate pairs sequentially by sending STUN binding requests directly over UDP from the local socket to the remote candidate’s UDP address:

• Opening NAT Mappings: When a STUN request is transmitted via UDP, the local NAT router creates an outbound state table entry, effectively opening a temporary port mapping.
• Symmetric NAT Handling: When both peers simultaneously send UDP packets toward each other’s public endpoints, NAT devices recognize the traffic as solicited responses, allowing incoming packets through the firewall without requiring manual port forwarding.
• Verification: When a peer receives a STUN binding request, it responds with a STUN binding response over the same UDP channel. A successful exchange confirms bidirectional connectivity on that specific UDP path.

Nomination and Direct Media Routing

After connectivity checks succeed, ICE selects the highest-priority working UDP candidate pair in a step called nomination. Once nominated, the signaling phase completes, and the application immediately transitions from sending STUN check packets to routing raw media streams (such as SRTP or SCTP over DTLS) directly across the established P2P UDP socket. ICE continues to send periodic UDP keep-alive packets to prevent NAT routers from expiring the active port bindings during idle periods.