STUN is a standard networking tool, not malware. It helps devices discover the public-facing address and port assigned by a NAT and supports connectivity checks and keepalives. Attackers can abuse related traffic in two distinct ways: spoof requests so a STUN server replies to a victim, or manipulate ICE negotiation so a peer sends connectivity checks toward a target. Those mechanisms have different requirements and defenses.
What STUN does
STUN (Session Traversal Utilities for NAT) lets an endpoint ask a server what IP address and port the server sees for that endpoint. A client sends a Binding request; the response can report the mapped address. That information can help applications attempt communication across network address translation (NAT), and STUN can also support connectivity checks and NAT-binding keepalives. The current core specification, RFC 8489, published by the IETF in February 2020, obsoletes RFC 5389.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Planet 4-Port SIP VoIP Gateway (4*FXS): IETF SIP 2.0, W125832721 ((4*FXS): IETF SIP 2.0, T.38/T.30,... | $259.00 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
Address discovery is not the same as proving that another device can reach that address. As RFC 8489 puts it, “STUN is not a NAT traversal solution by itself.” A larger process must use the information and test whether a path works. ICE (Interactive Connectivity Establishment) is one such process: it gathers candidate addresses and checks candidate pairs before selecting a working connection. The details depend on the application’s STUN usage and the full exchange, not merely on seeing the word STUN.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why STUN-related traffic can be abused
Two mechanisms are often conflated. One abuses a STUN server as a reflector by spoofing the request’s source address. The other uses ICE candidate information to make a peer send checks to a target. The sender, traffic pattern, and relevant mitigation differ.
#1 Best Overall
| STUN server reflection | ICE connectivity-check amplification | |
|---|---|---|
| What sends traffic to the target | A STUN server replies to a request whose source address was forged. | An ICE peer sends checks to candidate addresses supplied during negotiation. |
| Traffic pattern | One response packet per request; response data is typically somewhat larger. | Multiple checks may be directed at a target; RFC 8445 calls this an amplification mechanism. |
| Mitigation in the cited RFC | Ingress source-address filtering. | Limit the total connectivity checks; optionally restrict accepted candidates. |
| Key distinction | The basic reflector attack does not increase packet count. | Requires an ICE usage and peer behavior; it is not the same as spoofed-source reflection. |
1. Spoofed-source reflection through a STUN server
An attacker can send a STUN request with a falsified source IP address and port. The server’s reply is then sent to that forged address, which could belong to an uninvolved target. RFC 8489 describes the limit precisely: “There is no amplification of the number of packets with this attack (the STUN server sends one packet for each packet sent by the client), though there is a small increase in the amount of data, since STUN responses are typically larger than requests.” This is a small data-volume increase, not a many-packets-for-one-packet attack.
The mitigation named in RFC 8489 is ingress source-address filtering: networks should filter traffic with source addresses that should not legitimately originate from the sender’s network. The attacker’s ability to spoof a source address is a necessary part of this reflection scenario; it is not a property of every STUN request or server.
2. ICE connectivity-check amplification
ICE has a separate risk. An attacker can supply a peer with candidate addresses that include a target, prompting the peer to send STUN connectivity checks there. RFC 8445, the IETF’s July 2018 ICE standard, gives “say, 50” candidates as an illustrative example—not a typical count, attack rate, or prevalence statistic. The checks stop after ICE fails, but the standard still describes this as an amplification mechanism.
Free tools Windows power users keep installed
One-click scans. No signup required.
RFC 8445 says, “ICE agents SHOULD limit the total number of connectivity checks they perform to 100.” This is a recommendation for an agent’s total checks, not a guarantee that every implementation enforces the limit in the same way. The standard also permits limiting the number of candidates accepted. It notes a WebRTC scenario in which malicious JavaScript could trigger checks in the background without a user realizing they are happening; that describes a possible attack path, not normal behavior of every website or WebRTC session.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can STUN expose your IP address?
It can reveal address information as part of connection setup, but that does not mean STUN always causes a privacy leak or that every browser and VPN behaves alike. ICE candidate gathering can produce server-reflexive addresses, and candidate exchange can expose addresses to someone able to see the negotiation. RFC 8445 specifically warns that server-reflexive addresses gathered through a VPN’s local interface may be sensitive. This is a conditional privacy concern, not evidence that all VPNs leak addresses or that a particular VPN prevents exposure.
Implementations can control which network interfaces are used to generate candidates. RFC 8445 recommends providing a programmatic or user interface for that control where the issue can arise. The standard does not establish the exact controls or defaults in any particular browser or service.
When candidate manipulation can redirect traffic
ICE server-reflexive candidate gathering uses STUN Binding requests that are not authenticated in the same way as later connectivity checks. RFC 8445 describes ways false candidates might be introduced, including compromised DNS, an injected fake response observed by an on-path attacker, or a compromised STUN server. A false address learned during gathering does not by itself ensure that session traffic will be redirected: the candidate must also pass connectivity checks to carry data.
For message manipulation and bid-down concerns, RFC 8489 describes message-integrity mechanisms and says TLS or DTLS channel protection mitigates relevant attacks. Which protections apply depends on the STUN usage and transport; the presence of STUN alone does not tell you which controls are in place.
Quick Recap
How to interpret STUN traffic you see
- STUN traffic by itself is not evidence of malware. Applications use it for address discovery, connectivity checks, and keepalives.
- Separate address discovery from a working connection. A mapped address is what a server observed; ICE checks whether candidate paths actually work.
- Distinguish the two attack paths. Reflection involves a server replying to a spoofed source; ICE amplification involves a peer sending checks to supplied candidates.
- Do not infer that every STUN server is abused or every VPN leaks. The standards describe mechanisms and conditions, not incident prevalence or the behavior of all products.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
