An Analysis of the Skype Protocol

zib writes "Ever felt a need to peek under the hood of your Skype client? This paper (PDF) explains all the details. Among other issues, it focuses on the NAT capabilities of Skype and audio compression."

Comments

Supernodes?

[gaber1187]

Interesting paper.

What is the deal with supernodes, isn't there a peer to peer protocol that doesn't revolve around supernodes? I don't like the idea of somebody setting up a high-bandwidth machine and routing enough packets to get the entire phone call I'm making and then in their spare time decrypting my phone call.

We need a a VoIP method that uses bit torrent and duplicates what you are saying many times, which wastes bandwidth but makes up for the slowness factor. And even still, we need a bit torrent less reliant on supernodes... could a VoIP network function on a P2P network meant to work without supernodes?

Somebody know more details about what the difficulties are in making a P2P network without supernodes? (Assuming there are lots of people on the network).

Privacy issues?

Re:Supernodes?

[awolk]

I don't like the idea of somebody setting up a high-bandwidth machine and routing enough packets to get the entire phone call I'm making and then in their spare time decrypting my phone call.

Well, I can't read the paper, because I don't have a pdf reader available, but I think they've done the crypto-stuff good enough, so that it's almost impossible to decrypt.
What is the point of decrypting something if it takes >100.000 years?

Re:Supernodes?

[Anonymous Coward]

You're going to need a pretty super node to decrypt 256-bit AES.

Re:Supernodes?

[Thrakkerzog]

I don't think that your phone call data goes through the supernode. From what I understand, the supernode is used to facilitate the connection between two clients which are behind NAT or a firewall. After the supernode hooks you up, it is a direct connection between the two clients, without the supernode involved.

Re:Supernodes?

[kuwan]

What is the deal with supernodes, isn't there a peer to peer protocol that doesn't revolve around supernodes?

Because this type of tiered network is what works and scales well to thousands and millions of clients. The original Gnutella protocol was designed not to use "supernodes" or a tiered network structure and it was a miserable failure. The bandwidth and large latency required for all of the clients to communicate with each other (especially ones using 56K modems) easily overcame the usefulness of the network. The current Gnutella protocol now uses a tiered (layered) network where clients can become supernodes and this version actually works with tens to hundreds of thousands of people connected.

When creating a large, scalable network this type of protocol is what has been proven to work.

--
Join the Pyramid - Free Mini Mac

Re:Supernodes?

[jd]

The problen with loading the network up is that you increase the latency (spare packets have to be processed enough to know to drop them) and you increase the packet loss overall (because if everyone does this, packet collisions will increase exponentially).

There are other solutions which'll do essentially what you want. One option is to have connections rotate round-robin style, rather than by bandwidth. That way, if you can go by 5 paths, each path gets 1/5th of the traffic, making it much harder for evesdroppers.

A second option is to use kernel or userland IPSec, so that all connections are secure. IPSec is pretty solid and it is doubtful anyone would be able to break into such traffic.

Supernodes are just a load-balancing mechanism. Not a very good one, because it's a two-state system, but it works. Networks have developed routing and QoS protocols to handle exactly the kind of information P2P is approximating with the supernode scheme. It would seem to make much more sense to use mechanisms people have worked on for much longer to get right.

Re:Supernodes?

[bigberk]

Not necessarily. There exist ways to get through a double NAT environment. We developed one such system for an engineering thesis; for documentation on another see the "STUN" RFC

Re:Supernodes?

[cyngus]

The problem is that QoS-aware protocols are not universally deployed, so you can't count on them. Additionally most of the router-based QoS protocols suck. Adding "smarts" to the network infrastructure goes against the original Internet design principles, which dicatated that the network should be as dumb as possible and add the smarts to the end hosts.

Re:Supernodes?

[drew]

i've seen someone experimenting with this before. it's actually not too difficult to do once you have two computers that are both trying to set up the connection. how to alert the second computer that the first wants to initiate a connection is the challenge. in this case the supernode seems to be responsible for that aspect.

basically each computer attempts to initiate a connection to the other computer on a port that has been agreed to in advance. the first computer to attempt will fail, due to the firewall on the other end. however, his firewall will now be expecting return traffic originating from the port that his computer attempted to connect to. therefore, the second connection attempt, from the other computer, will succeed. now, both firewalls are allowing return traffic through in response to a connection initiated from inside the firewall. all the supernode has to do is allow for negotiation of timing and source and destination port numbers, and the rest is quite simple.

Re:Supernodes?

[Stween]

"Somebody know more details about what the difficulties are in making a P2P network without supernodes?"

It's not difficult, but the issue is scalability. To have a P2P network scale, you have to have some efficient network structure for shunting data around. Efficient is a relative term; robustness might be the goal here with supernodes.

For implementations of distributed hash tables, bandwidth certainly isn't the main concern, so those are logically constructed generally without any concept of a supernode. The issue on a DHT is to achieve an efficient number of overlay hops from any one node to any other no matter how many members are in that DHT space.

When you're conferencing calls and numerous people are sending/recieving data, it simply makes sense to try and push lots of data through fat pipes, and less data through thinner pipes. This means that any P2P overlay designed to facilitate conferencing applications should place peers with high bandwidth/low latencies to others in positions whereby the inevitable duplication of packets (compared to IP Multicast) doesn't hit it quite so hard as the poor guy sitting on a 56k modem in the UK while the rest of the conference is on fast connections in the US.

It's been about three months since I read this Skype paper, so I can't quite remember where the supernodes are used. I think my description above will apply to the way it constructs its overlays for conferences themselves, but supernodes are elected to maintain whatever structure they have in place for lookups on usernames.

My current work involves writing an open-sourced implementation of a P2P protocol which allows conferencing applications to be built on top; I've looked at lots of protocols. The protocol which I am implementing will theoretically scale only to groups of size ~100 (for the conferencing itself; there's no reason a lookup mechanism could be run alongside, which is undoubtedly what Skype is doing in some sense).

The code will be released on sourceforge when I can think of a good name.

Re:Supernodes?

[acaspis]

however, his firewall will now be expecting return traffic originating from the port that his computer attempted to connect to. therefore, the second connection attempt, from the other computer, will succeed

Interesting, but I wouldn't expect this technique to defeat anything else than trivial "personal firewalls". Any NAT between the two computers would alter the calling ports and break your assumptions.

Has anyone actually tried this ?

How future proof is this?

[Samir Gupta]

I believe the NAT traversal is done by routing via super-nodes which are not behind a NAT or firewall. Is this a valid assumption for the future? In other words, what if every host is behind a NAT or firewall -- it seems that way, given the increased security conciousness of hardware and software makers, that sometime in the near future, firewalling will be the norm and default, not the exception?

Bad start

[Sanity]

Skype is a peer-to-peer VoIP client developed by KaZaa...

KaZaa isn't a company, it is a piece of software. Skype was developed by the same guys that were behind the KaZaa software, but not (to the best of my knowledge) by the company that now owns KaZaa.

Re:Bad start

[Sc00ter]

This is slashdot, what do you expect.

Skype Banned

[Realistic_Dragon]

Do you really want to be running Skype or let it onto your network? At my university Skype has been banned. Here is the reasoning:

Skype Peer to Peer Telephony software is now also prohibited. Skype is a
free application that facilitates free telephone calls through the use of
an internet connection.

Calls made using the system are directed through 'Supernodes', which can be
ordinary PC's with Skype installed. Machines on fast and well connected
Internet feeds like the $Network are likely to automatically become
'Supernodes' and forward a considerable amount of traffic.

This allows Skype to route other peoples Voice over IP calls using your
machine and the university internet connection. This is in breach of the
Acceptable Use Policy and could potentially put the university's network
and core business at risk.

Finally, the Skype End User License Agreement (EULA) grants Skype permission
to install and use 3rd party software on computers running Skype. This could
include an array of spyware and adware that is likely to threaten the
privacy of anyone installing this software.

Re:Skype Banned

[JJahn]

I checked out Skype's EULA as found on their website.

The only thing relating to third party software that I found was this:

2.4 Third Parties. You acknowledge and agree that the Skype Software may be incorporated into, and may incorporate itself, software and other technology owned and controlled by third parties. Skype emphasizes that it will only incorporate such third party software or technology for the purpose of (a) adding new or additional functionality or (b) improving the technical performance of the Skype Software. Any such third party software or technology that is incorporated in the Skype Software falls under the scope of this Agreement. Any and all other third party software or technology that may be distributed together with the Skype Software will be subject to you explicitly accepting a license agreement with that third party. You acknowledge and agree that you will not enter into a contractual relationship with Skype or its Affiliates regarding such third party software or technology and you will look solely to the applicable third party and not to Skype or its Affiliates to enforce any of your rights.

Basically, you have to explicitly accept a license agreement with the third party. They say nothing in here about installing and using 3rd party software on your computer without your consent.

Re:Skype Banned

[pVoid]

Yeah, but you don't understand what network topology means if you think peers' nodes will be used to relay data.

Generally speaking, end users are at the very bottom of a long hierarchy of ISPs and pipes. For example: UUNET -> AT&T -> Your local ISP -> You. As such, generally speaking, you are a leaf on a very large tree that may span several classes of IP networks. If a peer were to be used as a super node, it would mean that the data send from A to C would travel like this: A -> ISP -> AT&T -> UUNET -> Verizon -> Bell -> ISP -> B -> ISP -> Bell -> Verizon -> SomeOtherCarrier -> SomeOtherLocal -> ISP -> C.

It makes no sense since in all likelyhood, UUNET, Verizon and SomeOtherCarrier are all on the same backbone, one or two hops away from each other.

It only makes sense in a LAN situation, like in Campus setups where there are nodes that are 'above' other nodes hierarchically: like if someone has inbound Internet over one box and distributes the connection to his dorm house connected to 8 other computers.

And aside from that, Skype coms are encrypted. No third party software can intercept a properly encrypted message. That's the whole point of PKI, to avoid man in the middles.

Re:Skype Banned

[grazzy]

a troll a day keeps the insanity away.. ?

Re:Skype Banned

[WolfWithoutAClause]

It makes no sense

Um, actually RTFA.

In most cases the voice packets go direct leaf node to leaf node.

However if both are behind NAT firewalls then they can't directly talk to each other, and the Skype protocol seems to pick another Skype users machine (picked by some scheme that probably isn't publically described anywhere) and route the packets through them.

There's no security problem with doing this (the packets are end-end encrypted), it just takes longer and is more likely to congest, and it takes up bandwidth at the extra users network.

Really, IMNHO, NAT is a real menace. I'm really looking forward to IPv6 which doesn't have all this garbage; should be here by 2100 I reckon.

Windows registry? what's that?

[froggero1]

Skype stores its buddy information in teh Windows Registry. Buddy list is digitally singed and encrypted.....

Strange, I have it installed on my linux machine... and it doesn't have a windows registry... guess I dont have the capability of storing a buddy list.

Worst thing about Skype. . .

[aarku]

The program can automatically elevate itself to a Supernode and start chewing bandwidth. Not only that, but it alerts your friendly University system administrator that you may be "sharing copyrighted materials with Kazaa" and you have them frowning at them (and randomly shutting off your port because they believe you have been "hacked") Just use a different free Internet Telephony application.

Re:Worst thing about Skype. . .

[alirano]

You can easily avoid becoming a Supernode by not permitting incoming connections to the port Skype has opened for itself. The downside to this is that your calls will now be routed to another supernode, but if you're paying for bandwidth, there may be no way around that. You can still place and receive calls, and the added latency is not worth mentioning in most cases.

If you run Skype on Linux or Mac OS X, it is reduced to using high ports anyway, so it's easy to block. An example iptables command line would be

iptables -A INPUT -p tcp --dport 1024: --syn -j DROP

(Caveat: Check your local servers, use passive FTP, modify this if you actually want to use P2P, etc.)

Non-Windows stuff

[JohnQPublic]

FYI, if you want to look at the "registry" info for Skype on Linux, it's in $HOME/.Skype/shared.xml.

Don't knock it.

[Facekhan]

Proprietary or not, it works and its easy to use. Skype does a lot of things differently than SIP. 256 bit AES encryption is strong enough to protect your data well into the near future.

It uses very little bandwidth and those Universities who are banning the software are just kneejerking to a new technology, just showing how far from the academic mission of research and experimentation most colleges have gone. Even more telling is how most Colleges charge exorbitant fees for local and long distance phone calls from student dorm phones. Why would they want to allow a technology onto their network that will mean less money going into their pockets.

As to the bandwidth issues, I think they greatly exaggerate the bandwidth use of a Skype supernode in order to justify their kneejerk reaction to any new technology on their network that does not come with a 3 year agreement with Dell and Microsoft.

Re:Don't knock it.

[alirano]

I've seen one Skype supernode in action and was pretty impressed by the bandwidth it was using. It was getting more than 15000 connections an hour, coming close to saturating its 100 mbps pipe. Which is kind of okay if you're paying a flat rate for access, but if you're paying by volume, I suggest that you take measures to avoid becoming a supernode. It's easy enough to do so. (On Linux, just block the high ports you're not using yourself. On OS X, activate that firewall.)

Re:other VOIP providers?

[leonscape]

I do think your wrong about it being tripe and useless. Skype will will succeed, and be around for quite a while.

Simply because it is so damn easy to use, It has clients for Windows, Mac OS X and Linux, and all you need is the ID of anyone you want to call. No screwing around.

I ain't no fan boy, but after using SIP and Skype, I know which the majority of users are going to find easier to use.

Also check out http://www.ilbcfreeware.org/ for the codec.

Any more docs like this?

[PetoskeyGuy]

NAT tranversal is great, and Skype is nice an solid. We're adding this to our next product. Does anyone know where I could find more documents like this?

200 Mhz

[fist]

Did anyone else notice that their test machines were 200 Mhz Pentiums running Windows 2000.

I bet they couldn't only see 5kbytes of traffic because that's all those poor machines could pump out!

Re:other VOIP providers?

[jacksonj04]

However, what most VoIP solutions seem to lack is the idea that you can install them and 'phone' an IP address. You still need a number, it still traverses over POTS for the most part, and it usually costs. Skype just works over existing networks, and whilst I'm no fan of locking people into one solution Skype does actually work.

How often does skype refresh NAT binding

[moshiko]

Every gateway may have different timeouts for NAT UDP port binding, right?
The PDF doesn't explain how it's done, but it's rather simple, and is explained in the STUN RFC:
1. Open a socket, and tell the server, hi, i'm here, reply to the same address you received this message from, and tell me what that address is (let's call this address REF_ADDRESS_A).
2. Sleep for some time...
3. Open a second socket, and say, hi, i'm here, reply to the same address you received this message from AND to the old address(REF_ADDRESS_A)

If the first opened socket receives the message as well, this means the binding is still valid.
Increase the timeout and try again.
Otherwise, decrease the timeout and try again.

Eventually, it finds the right timeout for the binding.

Having said that, a proper app should really run this routine periodically, because network elements may change.

Re:I can knock it if I want to...

[Facekhan]

As to the bandwidth costing money. Traditional VOIP does not use very much bandwidth and neither does Skype. It uses less than the client of a multiplayer game. What VOIP does require though is fast, consistent delivery of packets. I have a suspicion that one of the issues that College network administrators are concerned about is that VOIP will expose how inefficient and poorly managed many .edu networks are mostly by virtue of the fact that the higher ups in the .edu tech departments are always people who wouldn't know a router from a plunger and they mostly just hand down ridiculous memos full of meaningless buzzwords from the Microsoft and Dell sales pitches. My dept was ordered to manually install 5000 copies of mcaffee personal edition, patch the windows machines on every student computer and then manually trace thousands of unlabeled switch ports in order to make sure no one who had not had mcaffee installed yet had their port turned on. All noted down on scrap paper and hopefully sent to the people who were in command of the switch blades who would hopefully turn on the right ports.

I had to explain to angry parents and students why their 30k a year private university was taking 2-3 weeks after classes started to turn on internet connections. It took about 35 of us (about 28 of them outsourced) 3 weeks just to get the students who really cared about getting online turned on.

Total cost about $600,000. Now why couldn't we have bought a few antivirus appliances to put in the dorms and some routers or firewalls to break up the big broadcasts domains being used to spread the viruses in the first place? Why couldn't we just install a remote administration client on student machines so we could run antivirus and patches automatically?

Re:other VOIP providers?

[DarthBart]

They all run at least SIP. But with them, there is very little reason to try to work on a peer to peer connection since 95% of their traffic is going to terminate over the PSTN, not to another IP phone.

But, even with that, there is a feature in SIP called "REINVITE" in which two SIP endpoints can renegotiate their media stream paths to send their audio directly to each other and only send call progress messages to the original server (for billing purposes, mainly). Reinvite really only works well if both endpoints are not behind NAT, though and there is an issue with compatibility between vendors.

Re:I can knock it if I want to...

[Psx29]

Are you learning anything by using Skype? No. Is it advancing research? No.

I use Skype all the time to practice and learn foreign languages, and to collaborate with people located in different regions of the world. I would definately say there are many educational applications for Skype, and banning this software from a network is most probably due to a lack of understanding.

Skype vs a SIP solution

[SpooForBrains]

I "discovered" Skype, discovered that it was Linux friendly, and tested it sufficiently to find that it was quite adequate to meet my minimal requirements. So, I asked our technical guru to install it in the office where all the machines also use linux and have a look. I work from home, and since we spend a lot of time on the phone I figured we had the potential to save some money.

He muttered that he'd get around to it sometime, so next time I was in the office I installed it myself, and using the USB VOIP handset he had bought about a year ago for this precise purpose we had a little testing session and found it very useable (we also found out that with our wireless lan my laptop could become the most expensive portable phone ever).

So, next day, at home, I go to call him up and find his skype username offline. I mail him and ask him to log back on, to which he replies that he's not going to, he's experimenting with a SIP based solution, and since that's the protocol Skype must use anyway (no amount of arguement to the contrary got through) he could set up an improved solution.

We experimented for a week with an asterix server and KPhone. It sucked. He bought winmodems to get us external phone access on the system, faffed about for a while, and guess what, many months on, we're still using the phone network and running up the bills.

Now, I'm not arguing that an open source self-managed SIP solution is not the superior option, it almost certainly is. But Skype JUST WORKS.

Oh, yeah, does anyone know the correct pronounciation of Skype? It reads in my head as SKIPE, but a friend of mine insists it's correctly pronounced SKIPPY.

Skype + Asterisk will be the ideal couple

[Falsebart]

I would like to see an Skype Asterix extension.
http://voip-info.org/tiki-index.php?page=bounty%20 skype
That would be the real killer POTs killer app.
Can any reverse engineering pro give a hand ?

... and on OS X it's in your Library:

[alirano]

~/Library/Skype/shared.xml