A short technical discussion (Q&A) between Tsahi Levent-Levi and Philipp Hancke comparing ICE-TCP and TURN/TCP for media connections. They explain both let clients use TCP when UDP is unavailable, and contrast typical deployments: ICE-TCP connects directly to a media server (server opens port and client connects), while TURN/TCP uses a TURN server to allocate an outbound port (client → TURN → media server). They note TURN supports TLS (TURN-TLS) for traversing strict firewalls, ICE-TCP lacks a standardized TLS variant, and some projects (e.g., Jitsi) prefer TURN servers over ICE-TCP.
Chapters
Which is better, ISTCP or TURN tcp? And we need to start by explaining a bit. What is istcp, I think.
Okay, so both are ways to connect to either a turn server or an SFU over tcp. And they do very similar jobs in different contexts. For ICE TCP, you're typically talking to a server. TurntCP, you're talking either to a server or to a peer to peer client. But peer to peer clients over TCP is pretty rare. Both protocols allow you to establish and run a Web3 connection over a TCP connection. And so they're very similar. The difference is that for istcp, you have a server which opens a port and tells you connect to me here. For turn, you're basically asking a turn server, please give me an open port. You negotiate with the turn server first. You have some handshakes in between, and then you can establish the webc connection over there.
I think what you missed there was when you say a server, you actually mean the media server. So that if I want to connect a group call, or for whatever reason I want to have a meeting through a media server, I can decide to go through a turn server. So I would go from my client to the turn server to the media server, or I can go directly from the client to the media server. If it's on udp, I might go directly or through to a new dp. And if I don't have UDP available because it's blocked, I can either go TCP through the turn server, which is kind of the classic way of doing things, or with ICE tcp, directly to the media server. So I limit or remove the need for a turn server in that specific scenario and use case.
Yes. I mean, some people have simply implemented turn in their media server as a protocol, which is another alternative. The other difference is that for iccp, we don't have a standard way to say we need to use TLS as a Google proprietary SSL TCP variant. It's not clear whether it still works. Google Meet still uses it. But for turn, we have TURN tls, which gets you through some more firewalls in the end. Try both, see which one works for you to.
I guess if you're happy with turn tcp, you can stick with it.
Yes, I mean, I know the Jitsi folks got rid of iced tcp, said we have more turn servers, we just use the turn servers, which we need anyway.
