How To Create UDP Peer-To-Peer Connections With Netcat

[@EngineerMan]

I would tell everyone a UDP joke, but I'm not sure anyone would get it.

[@devnull365]

I didn't get that what was it about?

[@ray_gannon]

Groannnnnnnnnnnn

[@MartinPHellwig]

Well what is it then, broadcast or multicast?

[@notyoursurya]

"Use UDP over TCP to avoid handshakes" ? 🤔

[@ibnbroly]

Nice one haha

[@rickmellor]

I'm STUNned that you're talking about this stuff! 😀

[@EngineerMan]

Relevant pun. I dig it.

[@cloudtraining3816]

sorry i don't get it, but i'm curious, please explain

[@rickmellor]

@@cloudtraining3816 here you go. en.m.wikipedia.org/wiki/STUN

[@Nafrayu]

@@cloudtraining3816 "STUN" is a technology that helps with NAT traversal, hence the "STUNned" pun :D

[@justbendev2324]

Great job , this is the easiest way to explain hole punching to someone.

[@emmanuelpetit9064]

Informative and Straight to the point as always thanks :). I've learned so much from you!

[@aniket00796]

WebRTC would be a cool example for demonstration purposes.

[@ddjazz]

great stuff , title should contain "udp hole punching"

[@idk____idk6530]

To the world, you may be just a teacher but to me, you are a hero! Wishing you a Happy Guru Purnima! I bow to the one who has inspired me and taught the right way of life! You are the inspiration who made me overcome every hurdle in python ❤️

[@UnixDaemonKiller]

When Anycast starts interfering with this shit really hits the fan.

[@SirKenchalot]

I think you could have explain more about the hole punching mechanism itself; how doe sit work without opening ports on the firewall?

[@cl60cruzer]

Watch between 1:40 and 3:00 again. All "inbound" traffic is firewalled. So he can still dial out. Because hes making requests on both sides the traffic gets through. If outbound traffic was blocked too, then youd be stuck.

[@AureliusAurelius]

@@cl60cruzer I still don’t get it. Inbound traffic is still blocked, no?

[@funkypocorn]

@@AureliusAurelius It's because nowadays you are almost in any case dealing with so called stateful firewalls. Since its a linux machine it's probably iptables, firewalld or sth. similar. So when he sends out the package with src-port 50001 and dst-port: 50002 to ip ... the stateful firewall marks/flags this packet so every return packet for it arriving with dst-port 50001 within a certain threshold time is considered as the answer packet by the firewall and therefore let through. This is often also called UDP pseudo state in firewall systems. For the timeout I think the default is 30 seconds but could be changed in /proc/sys/net/netfilter/nf_conntrack_udp_timeout

[@AureliusAurelius]

@@funkypocorn wow, so interesting. Thank you

[@funkypocorn]

@@AureliusAurelius Just a few info to add: if you are on a linux system with iptables, most likely a rule like this is in place on your INPUT chain: " -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT" This lets this so called established udp connection/flow pass, which was created from your outgoing packet with src-port:50001 dst-port:50002 you send earlier. Because this pseudo state or in firewall slang called flow got created your input chain let's it go through. If you want to dig in deeper I recommend reading about connecting tracking via the conntrack module within the linux kernel.

[@thefather8362]

Great video. This is exactly why most corporate networks disable up, at least my company does.

[@haroldpepete]

something that you miss, Isp currently makes Carrier Grade-nat, that means you have multiple state nat inside Carrier network, too many customers navigate with one public ip

[@grp635]

In this case, the technique won't works?

[@haroldpepete]

@@grp635 it doesn't work, isp uses Carrier Grade-nat and.your router have to make multiples jump inside carrier.network to navigate to internet, you can use traceroute to see how many jump makes your pc to navigate

[@himanshushukla787]

No BS straight Info. That's Engineer man for you. :)

[@u0000-u2x]

I may be wrong here so please correct me, but this doesn't work as explained without a 3rd server. It is not punching a hole in the NAT because his machines are not using a NAT. If they were the NAT would change the source port. To do a hole punch behind NAT you need a 3rd party server that has visibility on the ports used by each of the two NATs.

[@gerooq]

Exactly. The source port changes on an outgoing packet after it leaves your network

[@Smiff3447]

Did not think this was possible without port forwarding or a third server. From what I understand, this only works with UDP since it's "connection-less", or is this also possible with TCP?

[@Belioyt]

It's in the title, did you watch the video?

[@MartinPHellwig]

You could always encapsulate TCP over UDP, though unless you know what you are doing you are going to have a world of pain with determining appropriate MTU and TTL values.

[@gerooq]

@@Belioythe had a valid question you just didn’t understand his question

[@qock1106]

Looking forward to part 2!

[@melvinhicklin5752]

Nice information! Looking forward to the next part!

[@mathewcohen3826]

Good job. Thanks for taking the time to explain that. These things (NAT) we use every day and often don't really know whats going on in there. :-)

[@kevinkkirimii]

tres bien, thank you, mungu akubariki

[@robertperaltab]

Great video! I didn't quite get why you chose port 5002 when punching the hole. Is that arbitrary?

[@supernovaw39]

Yes, as long as they are used consistently. What is source port for one machine is the destination port from the standpoint of another machine.

[@jazzthedog1]

Interesting stuff, great demo, but how can this be used in a practical manner? This is not a technique that can be leveraged safely in an app? How are companies using this technique currently?

[@AlfonsoRoque257]

First al all it is a good explanation, solve part of some daub that I had. But, I have a question, what you show in this video only work because those ip are public? In case I wan to do that between two privates pc (behind a NAT)? Thanks!

[@imlucluc]

really appreciate the demo

[@soupnoodles]

This is perfect, Love your videos 👍

[@richo13]

Looking forward to the next vid

[@Andrew90046zero]

I know somone may have mentioned somthing about this, but at 6:37 when you send a message from p2p1 to p2p2, and there is still no message recieved on p2p2 listener, and that's because on p2p2 you only punched a hole for port 50002, but p2p1 was trying to send a message to p2p1. So nothing came through. A p2p1's hole punch was on port 50001, and p2p2 was sending packets to 50001. This kinda confusing me when I was trying to write my code in C#, but I eventually figured out what was going on. So when you hole punch, you want both routers (for simplicity sake) to punch a hole for the same port (in your case 50001), it seems like the destination port (50002) doesn't matter as much. But I could be wrong on that.

[@socksincrocks4421]

what about traffic security? Is the transfer of data encrypted / secured by netcat?

[@melsonmascarenhas]

This code will only work on machine with direct public IPs , not device behind NAT

[@dominykas5195]

Is it possible for two devices behind NAT to establish a peer to peer connection?

[@reyuki-i]

what is network condition that prevent UDP hole punch technique? or this technique will work all the time and only need both peer to be connected to the internet?

[@tatterdemalion898]

Hello, i would like to make a server client app, where i would chat, and i was thinking to use a server somewhere over the internet, as php could handle the handshaking process and the clients i would write in C. C is not a problem for me, but networking is. Could you point me in the right direction to read up on this, or if there is an example somewhere for me to take a look at.

[@stephenkamenar]

this video was so sick dude

[@frankfrank8799]

Nice one... learned something... quickly... THX

[@danlee1027]

Great video. Love the how-tos!

[@amrhegazy7221]

i've got nc: bind failed: Address already in use

[@billprice3899]

Curious if this leaves either machine vulnerable for anyone to take advantage of with no passwords, encryption... port scanners?

[@benargee]

I would imagine it's up to the service bound to that port to properly implement security. A secure protocol can be implemented on top of an insecure one as can be done with plain text on a sheet of paper. The firewall should also have outbound traffic timeouts so that it will not accept inbound traffic indefinitely.

[@jayadevashok2070]

Are the port numbers the router's port numbers or the vm's?

[@jayadevashok2070]

Also does the first command not result in a NAT entry on either router?

[@reyuki-i]

6:39 wondering why you can reuse the port on p2p-01 machine?

[@AkshayGupta-dd4ht]

I successfully created hole punching... Just a suggestion... If you made.. just use Single socket for all.. with different IPEndPoints

[@gerooq]

That’s what I did

[@xspeed7434]

So at 6:20 you are typing the command to send from p2 to p1. I see you specified a source port. If I wanted to only do a one way connection where I only send from p2 to p1 would this work if I didn’t specify source port like u did at 6:20?

[@Melsss3305]

you earned a subscribe thanks

[@Fereri07]

Hey. I wonder how do you know that the port chosen on the computer will be the same as the port chosen on the firewall? Especially if the firewall is on an external machine like a router.

[@justbendev2324]

Since this a VPS with a public ip he is the firewall so anything he can bind to is free so he knows if he request source port 50001 it will go out with 50001. He's using a oversimplified setup to explain the concept, unfortunately in the real world its a bit more complicated than this because each nat type will handle the outgoing port differently so you can't predict the output port without some help. That why stun servers exist You both ask the stun server which port you have used viewed from the internet and then forward this information to your peer / other client.

[@Reyelll]

Excelente video

[@ianbdb7686]

Next do how to use remote device to steal transaction data

[@FreeDomSy-nk9ue]

Awesome thanks

[@tomwimmenhove4652]

I'm surprised netcat lets you pick a source port that's already in use by the other process listening on it. I'm simply getting an 'address already in use' error when running the hole punch command.

[@JonathanJardine]

Me too not sure how he got around this.

[@AareffSystems]

YES, me too, tried everything, but always an error saying port is already being used @@JonathanJardine

[@michaelmounts1269]

great video…Ive used version in past to scan ports, etc in “zero mode” …not really new..but cloud environments make it mire useful

[@martinseminsky8580]

COOOOOOOOOOOOOOL ! THANKS

[@garyprice3757]

Hi. great vid. Not used DO for a while but I remember that they issue the public IP to the interface directly. So in this case, surely it will be upnp that is dynamically opening the port mapping through the fw and not natting?

[@elegantchrisarts001]

Nicely explained. By the way, do you do hacking ? You're so smart in how you explain your videos!

[@d1ddle]

Cool 👍 I'm making a multiplayer python game so I'm interested in the next vid

[@ibnbroly]

Honestly you can get some useful info from this video but you will, in most cases, not use p2p for video games. It can still be a cool project tho

[@kooltyme]

@@ibnbroly if its a game where the connection between two playesr really matters, liek a fighting game for example, then p2p would really help

[@jonasavory8339]

I dont really get how you can listen to port 50001 on both machines and then send data from the same port without stopping the listener... why is there no port already used-error?

[@noweare1]

I get a "bind failed: Address already in use' error

[@tw-721]

this doesn't seem to work on my network, it's stuck in the 'punch hole' command on both the machines. Are there any limitations to this?

[@aminghafoori6496]

information injection

[@venomxl1655]

Is there a way I could send a VPN over it ???

[@electr0nux]

Netcat is giving me bing failed: address already in use for the second command

[@EngineerMan]

If you get that error, run the second command first and then start the listener.

[@amir3515]

I did this and I still get the error. The issue with me is that when issuing the hole punch command, it just hangs and doesn't return control back to the shell. What could that mean? I am using 2 raspberry pis, one is connected to my home network and the other is using my mobile phone's hotspot. The error and hanging occurs on both pis

[@amir3515]

I found the reason for me. It's because i am on symmetric nat for both networks

[@martinseminsky8580]

@@amir3515 how did you find out?

[@amir3515]

@@martinseminsky8580 by querying a stun server as a stun client

[@n3r0z3r0]

why not terminator/tmux ?

[@LucasDoNascimento1989]

Not working. nc -u -l 50001 outputs UDP listen needs -p arg error

[@diaahanna8882]

Why can't this concept work with tcp?

[@Laflamablanca969]

Anyone else love the UDP vs TCP meme? 😂😂

[@abdelmalekaktir2608]

Some did not get your question, you must have sent it through udp

[@Laflamablanca969]

@@abdelmalekaktir2608 😂

[@m4l490n]

This video is awesome!! But then my heart was broken and everything went down the drain when you said you were going to use python for the second part. You should do it with bash scripting.

[@aristotlesimone4773]

Just wanted to share with everyone that I shit my pants again.

[@BunkMayne]

UDP segmentation 🤮

[@Pervy]

Please use proper social distancing and UDP signaling to reduce the spread.

[@furkansherifi5731]

why u dont make some hacking videos !!