The Alternative Network Address Types (ANAT) Semantics for the Session Description Protocol (SDP) Grouping Framework
obsoleted by
- rfc-5245 — Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal for Offer/Answer Protocols
Extracted elements (15)
ANAT groups 'm' lines with different IP versions at the 'm' level rather than the 'a=' level (as ICE does) to keep IPv6 syntax free from ICE parameters used for legacy IPv4 NATs, yielding syntax closer to vanilla SDP where IPv6 addresses appear in their own 'm' line.
ANAT was designed separately from ICE because ICE only allows a single primary address when the peer does not support ICE, which would relegate certain address types (e.g., IPv6) to only be a secondary alternate. ANAT avoids this asymmetry.
The separation between ANAT and ICE also benefits systems that support both IPv4 and IPv6 but do not need ICE (e.g., multicast servers), keeping the two mechanisms cleanly decoupled.
ANAT is intended for scenarios involving different network address types (e.g., different IP versions). Systems needing alternative transport addresses of the same network type should use ICE instead.
The ICE format can be used within the individual 'm' lines of an ANAT group to provide additional addresses and ports, as shown in the Section 6 example where both IPv4 and IPv6 'm' lines carry ICE-encoded additional addresses.
An answerer receiving a session description that uses the ANAT semantics SHOULD use the address with the highest priority it understands and set the ports of the rest of the 'm' lines of the group to zero.
An offerer using SIP to send its offer SHOULD place the sdp-anat option-tag in a Require header field.
It is strongly RECOMMENDED that integrity protection be applied to the SDP session descriptions to prevent attackers from adding or removing ANAT group lines; for SIP, S/MIME is the natural choice.
The ANAT semantics MUST NOT be used to group media streams whose network addresses are of the same type; it is intended only for different network address types.
The entity creating a session description with an ANAT group MUST be ready to receive (or send) media over any of the grouped 'm' lines.
The identifiers of the media streams MUST be listed in order of preference in the group line, so that the first listed 'm' line has the highest preference among the alternatives.
ANAT (Alternative Network Address Types) is a new 'semantics' attribute defined within the SDP grouping framework, allowing media lines to express alternative network addresses of different types (e.g., IPv4 and IPv6) for a single logical media stream.
IANA has registered a new 'semantics' attribute token 'ANAT' (Alternative Network Address Types) for the SDP grouping framework, under Semantics for the 'group' SDP Attribute.
An attacker adding ANAT group lines to an SDP description could cause an endpoint to use only one of the streams offered by the remote end, when the remote end intended to establish all streams.
An attacker removing ANAT group lines could cause an endpoint to establish a higher number of media streams than intended; if the endpoint sends media over all of them, session bandwidth may increase dramatically.