Hi Oleg,
We have a turn server behind a load balancer in Rackspace (using -X).
Without the load balancer everything works fine.
With the load balancer, the turn server receives 2 consecutive allocate requests from the client, for each of them responds with a difference nonce and then the client is using the 1st nonce, which is already expired because a new one was created.
Here is the log from Wireshark:
Frame 13: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Cisco_3a:52:41 (e8:ed:f3:3a:52:41), Dst: Rackspac_20:35:1c (bc:76:4e:20:35:1c)
Internet Protocol Version 4, Src: 10.189.254.10 (10.189.254.10), Dst: 10.208.231.97 (10.208.231.97)
User Datagram Protocol, Src Port: 29978 (29978), Dst Port: 3478 (3478)
Session Traversal Utilities for NAT
[Response In: 14]
Message Type: 0x0003 (Allocate Request)
.... ...0 ...0 .... = Message Class: 0x0000
[Request (0)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 8
Message Cookie: 2112a442
Message Transaction ID: 397669475539576767766d68
Attributes
REQUESTED-TRANSPORT: UDP
Attribute Type: REQUESTED-TRANSPORT (0x0019)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
Transport: UDP (0x11)
Reserved: 000000
No. Time Source Destination Protocol Length Info
14 27.395681000 10.208.231.97 10.189.254.10 STUN 162 Allocate Error Response error-code: 401 (Unauthorized) Unauthorised with nonce realm:
temprealm.com
Frame 14: 162 bytes on wire (1296 bits), 162 bytes captured (1296 bits) on interface 0
Ethernet II, Src: Rackspac_20:35:1c (bc:76:4e:20:35:1c), Dst: Cisco_9f:f0:01 (00:00:0c:9f:f0:01)
Internet Protocol Version 4, Src: 10.208.231.97 (10.208.231.97), Dst: 10.189.254.10 (10.189.254.10)
User Datagram Protocol, Src Port: 3478 (3478), Dst Port: 29978 (29978)
Session Traversal Utilities for NAT
[Request In: 13]
[Time: 0.001472000 seconds]
Message Type: 0x0113 (Allocate Error Response)
.... ...1 ...1 .... = Message Class: 0x0011
[Error Response (3)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 100
Message Cookie: 2112a442
Message Transaction ID: 397669475539576767766d68
Attributes
ERROR-CODE 401 (Unauthorized): Unauthorised
Attribute Type: ERROR-CODE (0x0009)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Reserved: 0000
.... .100 = Error Class: 4
Error Code: 1
Error Reason Phrase: Unauthorised
NONCE: dbe20ef26ab9f4de
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: dbe20ef26ab9f4de
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
SOFTWARE
Attribute Type: SOFTWARE (0x8022)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 29
Software: Citrix-3.2.4.6 'Marshal West'
Padding: 3
FINGERPRINT
Attribute Type: FINGERPRINT (0x8028)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
CRC-32: 0x285664f8
No. Time Source Destination Protocol Length Info
15 27.493908000 10.189.254.10 10.208.231.97 STUN 70 Allocate Request UDP
Frame 15: 70 bytes on wire (560 bits), 70 bytes captured (560 bits) on interface 0
Ethernet II, Src: Cisco_3a:52:41 (e8:ed:f3:3a:52:41), Dst: Rackspac_20:35:1c (bc:76:4e:20:35:1c)
Internet Protocol Version 4, Src: 10.189.254.10 (10.189.254.10), Dst: 10.208.231.97 (10.208.231.97)
User Datagram Protocol, Src Port: 31845 (31845), Dst Port: 3478 (3478)
Session Traversal Utilities for NAT
[Response In: 16]
Message Type: 0x0003 (Allocate Request)
.... ...0 ...0 .... = Message Class: 0x0000
[Request (0)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 8
Message Cookie: 2112a442
Message Transaction ID: 397669475539576767766d68
Attributes
REQUESTED-TRANSPORT: UDP
Attribute Type: REQUESTED-TRANSPORT (0x0019)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
Transport: UDP (0x11)
Reserved: 000000
No. Time Source Destination Protocol Length Info
16 27.504800000 10.208.231.97 10.189.254.10 STUN 162 Allocate Error Response error-code: 401 (Unauthorized) Unauthorised with nonce realm:
temprealm.com
Frame 16: 162 bytes on wire (1296 bits), 162 bytes captured (1296 bits) on interface 0
Ethernet II, Src: Rackspac_20:35:1c (bc:76:4e:20:35:1c), Dst: Cisco_9f:f0:01 (00:00:0c:9f:f0:01)
Internet Protocol Version 4, Src: 10.208.231.97 (10.208.231.97), Dst: 10.189.254.10 (10.189.254.10)
User Datagram Protocol, Src Port: 3478 (3478), Dst Port: 31845 (31845)
Session Traversal Utilities for NAT
[Request In: 15]
[Time: 0.010892000 seconds]
Message Type: 0x0113 (Allocate Error Response)
.... ...1 ...1 .... = Message Class: 0x0011
[Error Response (3)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 100
Message Cookie: 2112a442
Message Transaction ID: 397669475539576767766d68
Attributes
ERROR-CODE 401 (Unauthorized): Unauthorised
Attribute Type: ERROR-CODE (0x0009)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Reserved: 0000
.... .100 = Error Class: 4
Error Code: 1
Error Reason Phrase: Unauthorised
NONCE: d03026f8b579e32f
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: d03026f8b579e32f
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
SOFTWARE
Attribute Type: SOFTWARE (0x8022)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 29
Software: Citrix-3.2.4.6 'Marshal West'
Padding: 3
FINGERPRINT
Attribute Type: FINGERPRINT (0x8028)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
CRC-32: 0x9c3bcf80
No. Time Source Destination Protocol Length Info
17 27.552372000 10.189.254.10 10.208.231.97 STUN 142 Allocate Request UDP user: temprealm realm:
temprealm.com with nonce
Frame 17: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits) on interface 0
Ethernet II, Src: Cisco_3a:52:41 (e8:ed:f3:3a:52:41), Dst: Rackspac_20:35:1c (bc:76:4e:20:35:1c)
Internet Protocol Version 4, Src: 10.189.254.10 (10.189.254.10), Dst: 10.208.231.97 (10.208.231.97)
User Datagram Protocol, Src Port: 7250 (7250), Dst Port: 3478 (3478)
Session Traversal Utilities for NAT
[Response In: 18]
Message Type: 0x0003 (Allocate Request)
.... ...0 ...0 .... = Message Class: 0x0000
[Request (0)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 80
Message Cookie: 2112a442
Message Transaction ID: 7536413258387871702f794f
Attributes
REQUESTED-TRANSPORT: UDP
Attribute Type: REQUESTED-TRANSPORT (0x0019)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
Transport: UDP (0x11)
Reserved: 000000
USERNAME: temprealm
Attribute Type: USERNAME (0x0006)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 8
Username: temprealm
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
NONCE: dbe20ef26ab9f4de
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: dbe20ef26ab9f4de
MESSAGE-INTEGRITY
Attribute Type: MESSAGE-INTEGRITY (0x0008)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 20
HMAC-SHA1: 01e9f5269185316a0702e64bbd807eea829e7827
No. Time Source Destination Protocol Length Info
18 27.567190000 10.208.231.97 10.189.254.10 STUN 162 Allocate Error Response error-code: 438 (Stale Nonce) Wrong nonce with nonce realm:
temprealm.com
Frame 18: 162 bytes on wire (1296 bits), 162 bytes captured (1296 bits) on interface 0
Ethernet II, Src: Rackspac_20:35:1c (bc:76:4e:20:35:1c), Dst: Cisco_9f:f0:01 (00:00:0c:9f:f0:01)
Internet Protocol Version 4, Src: 10.208.231.97 (10.208.231.97), Dst: 10.189.254.10 (10.189.254.10)
User Datagram Protocol, Src Port: 3478 (3478), Dst Port: 7250 (7250)
Session Traversal Utilities for NAT
[Request In: 17]
[Time: 0.014818000 seconds]
Message Type: 0x0113 (Allocate Error Response)
.... ...1 ...1 .... = Message Class: 0x0011
[Error Response (3)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 100
Message Cookie: 2112a442
Message Transaction ID: 7536413258387871702f794f
Attributes
ERROR-CODE 438 (Stale Nonce): Wrong nonce
Attribute Type: ERROR-CODE (0x0009)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Reserved: 0000
.... .100 = Error Class: 4
Error Code: 38
Error Reason Phrase: Wrong nonce
NONCE: 7a1516b5e1f2bdf5
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: 7a1516b5e1f2bdf5
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
SOFTWARE
Attribute Type: SOFTWARE (0x8022)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 29
Software: Citrix-3.2.4.6 'Marshal West'
Padding: 3
FINGERPRINT
Attribute Type: FINGERPRINT (0x8028)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
CRC-32: 0x6bc2b641
No. Time Source Destination Protocol Length Info
19 27.652143000 10.189.254.10 10.208.231.97 STUN 142 Allocate Request UDP user: temprealm realm:
temprealm.com with nonce
Frame 19: 142 bytes on wire (1136 bits), 142 bytes captured (1136 bits) on interface 0
Ethernet II, Src: Cisco_3a:52:41 (e8:ed:f3:3a:52:41), Dst: Rackspac_20:35:1c (bc:76:4e:20:35:1c)
Internet Protocol Version 4, Src: 10.189.254.10 (10.189.254.10), Dst: 10.208.231.97 (10.208.231.97)
User Datagram Protocol, Src Port: 2718 (2718), Dst Port: 3478 (3478)
Session Traversal Utilities for NAT
[Response In: 20]
Message Type: 0x0003 (Allocate Request)
.... ...0 ...0 .... = Message Class: 0x0000
[Request (0)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 80
Message Cookie: 2112a442
Message Transaction ID: 7536413258387871702f794f
Attributes
REQUESTED-TRANSPORT: UDP
Attribute Type: REQUESTED-TRANSPORT (0x0019)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
Transport: UDP (0x11)
Reserved: 000000
USERNAME: temprealm
Attribute Type: USERNAME (0x0006)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 8
Username: temprealm
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
NONCE: dbe20ef26ab9f4de
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: dbe20ef26ab9f4de
MESSAGE-INTEGRITY
Attribute Type: MESSAGE-INTEGRITY (0x0008)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 20
HMAC-SHA1: 01e9f5269185316a0702e64bbd807eea829e7827
No. Time Source Destination Protocol Length Info
20 27.661045000 10.208.231.97 10.189.254.10 STUN 162 Allocate Error Response error-code: 438 (Stale Nonce) Wrong nonce with nonce realm:
temprealm.com
Frame 20: 162 bytes on wire (1296 bits), 162 bytes captured (1296 bits) on interface 0
Ethernet II, Src: Rackspac_20:35:1c (bc:76:4e:20:35:1c), Dst: Cisco_9f:f0:01 (00:00:0c:9f:f0:01)
Internet Protocol Version 4, Src: 10.208.231.97 (10.208.231.97), Dst: 10.189.254.10 (10.189.254.10)
User Datagram Protocol, Src Port: 3478 (3478), Dst Port: 2718 (2718)
Session Traversal Utilities for NAT
[Request In: 19]
[Time: 0.008902000 seconds]
Message Type: 0x0113 (Allocate Error Response)
.... ...1 ...1 .... = Message Class: 0x0011
[Error Response (3)]
..00 000. 000. 0011 = Message Method: 0x0003
[Allocate (0x003)]
..0. .... .... .... = Message Method Assignment: 0x0000
[IETF Review (0)]
Message Length: 100
Message Cookie: 2112a442
Message Transaction ID: 7536413258387871702f794f
Attributes
ERROR-CODE 438 (Stale Nonce): Wrong nonce
Attribute Type: ERROR-CODE (0x0009)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Reserved: 0000
.... .100 = Error Class: 4
Error Code: 38
Error Reason Phrase: Wrong nonce
NONCE: 57d5e8f2b19b305c
Attribute Type: NONCE (0x0015)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 16
Nonce: 57d5e8f2b19b305c
Attribute Type: REALM (0x0014)
0... .... .... .... = Attribute Type Comprehension: 0x0000
[Required (0)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 12
SOFTWARE
Attribute Type: SOFTWARE (0x8022)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 29
Software: Citrix-3.2.4.6 'Marshal West'
Padding: 3
FINGERPRINT
Attribute Type: FINGERPRINT (0x8028)
1... .... .... .... = Attribute Type Comprehension: 0x0001
[Optional (1)]
.0.. .... .... .... = Attribute Type Assignment: 0x0000
[IETF Review (0)]
Attribute Length: 4
CRC-32: 0xef8217b8
Do you have any idea why this happens?
Thanks!