{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.tr.nat-traversal","code":"thing-q581558","url":"https://ver.cy/models/thing/q581558/","name":"NAT traversal","alternateNames":[],"kind":"thing","status":"published","version":"0.1.0-research.1","language":"en","classifiers":{"family":"Thing Registry","category":"Activities and processes","entryKind":"thing","plane":"ACT","domain":["ACT.ACT"],"industry":[],"navPath":"","tags":[],"facets":{}},"whatItIs":"NAT traversal is the set of techniques used to establish and maintain communication across network address translators when address translation and associated packet-filtering behavior prevent straightforward end-to-end connectivity.","purpose":"Enable an AI agent to recognise a NAT traversal attempt, assess whether its communication path works, and select authorised actions to establish or maintain connectivity.","scope":{"in":["Endpoint roles, intended traffic direction and observed translation boundaries","Discovery and exchange of candidate transport addresses","Direct connectivity checks and explicit port-mapping attempts","Relay allocation and selection when direct connectivity is unavailable or unsuitable","Mapping lifetime, path changes, failure diagnosis and traversal authorisation"],"out":["General NAT implementation, address translation tables and router administration","Application session semantics and media encoding","General firewall policy design and network access control administration","VPN tunnel construction and overlay routing beyond their relationship to a traversal attempt","Application identity, end-to-end encryption and content security beyond traversal dependencies"],"boundaries":[]},"distinguishingFeatures":["An instance must address connectivity affected by address translation; ordinary communication using directly reachable addresses alone is not sufficient.","Learning an externally observed address is a discovery result, not proof that the intended peer can exchange application traffic through it.","A direct traversal path exchanges endpoint traffic without a payload relay; a relayed traversal path forwards that traffic through an intermediary.","NAT translation behaviour and firewall filtering must be recorded separately because a reachable mapping does not establish permission to receive traffic.","A successful path is specific to endpoints, transport and observation time; success does not establish permanent or universal reachability."],"structure":{"bundles":[{"id":"communication-boundaries","name":"Communication boundaries","description":"Identify the intended exchange and the translation boundaries affecting it.","layers":[{"id":"endpoint-intent","name":"Endpoint intent","description":"Describe the communication that traversal must enable.","findings":[{"id":"required-exchange","name":"Required exchange","description":"Record endpoint roles, transport, address family and required traffic directions.","questions":[{"text":"Which endpoints must exchange traffic, using which transport and address family?","id":"required-exchange-q01","kind":"definition"},{"text":"Must either endpoint receive traffic before sending anything to the intended peer?","id":"required-exchange-q02","kind":"boundary"}]}]},{"id":"translation-and-filtering","name":"Translation and filtering","description":"Separate observed translation effects from traffic admission constraints.","findings":[{"id":"boundary-evidence","name":"Boundary evidence","description":"Record evidence of translation layers, filtering and same-network reachability without assuming the complete topology is visible.","questions":[{"text":"What observations support the presence of one or more translation boundaries on each endpoint's path?","id":"boundary-evidence-q01","kind":"provenance"},{"text":"Which tests distinguish mapping behaviour, inbound filtering and possible hairpin-path limitations?","id":"boundary-evidence-q02","kind":"measurement"},{"text":"Which suspected boundaries remain unobserved or outside the endpoint operator's control?","id":"boundary-evidence-q03","kind":"boundary"}]}]}]},{"id":"candidate-discovery-and-coordination","name":"Candidate discovery and coordination","description":"Maintain possible transport addresses and the coordination needed to test them.","layers":[{"id":"address-observations","name":"Address observations","description":"Track candidate addresses as contextual observations.","findings":[{"id":"candidate-context","name":"Candidate context","description":"Associate each candidate with its local interface or socket, discovery method and observation time.","questions":[{"text":"Was this candidate obtained from a local interface, a STUN observation, a peer observation, an explicit mapping or a relay allocation?","id":"candidate-context-q01","kind":"provenance"},{"text":"Which local socket and remote observation context produced this address, and when?","id":"candidate-context-q02","kind":"measurement"}]}]},{"id":"peer-coordination","name":"Peer coordination","description":"Record how endpoints exchange candidates and coordinate traversal checks.","findings":[{"id":"candidate-exchange","name":"Candidate exchange","description":"Bind exchanged candidates and check parameters to the intended session and peer.","questions":[{"text":"Which signalling channel delivers candidates and check parameters to the intended peer?","id":"candidate-exchange-q01","kind":"provenance"},{"text":"How are delayed candidates, simultaneous attempts and obsolete session parameters handled?","id":"candidate-exchange-q02","kind":"action"}]}]}]},{"id":"direct-path-establishment","name":"Direct path establishment","description":"Represent attempts to establish endpoint connectivity without a payload relay.","layers":[{"id":"connectivity-checks","name":"Connectivity checks","description":"Evaluate candidate pairs through actual traffic exchanges.","findings":[{"id":"validated-candidate-pair","name":"Validated candidate pair","description":"Track check outcomes for specific endpoint transport addresses and distinguish checks from application readiness.","questions":[{"text":"Which candidate pair completed a valid response exchange, under which check procedure?","id":"validated-candidate-pair-q01","kind":"measurement"},{"text":"What further evidence is required before declaring this pair usable for the application's traffic?","id":"validated-candidate-pair-q02","kind":"boundary"},{"text":"When should unsuccessful checks be retried, replaced by another pair or stopped?","id":"validated-candidate-pair-q03","kind":"action"}]}]},{"id":"explicit-port-mapping","name":"Explicit port mapping","description":"Represent requests to create externally reachable mappings through a supported gateway control mechanism.","findings":[{"id":"mapping-grant-and-reachability","name":"Mapping grant and reachability","description":"Separate a gateway's mapping grant from verified reachability across the complete path.","questions":[{"text":"Which gateway granted which external address, port, transport and lifetime for which internal endpoint?","id":"mapping-grant-and-reachability-q01","kind":"provenance"},{"text":"Does an external connectivity test confirm the mapping is usable beyond all intervening boundaries?","id":"mapping-grant-and-reachability-q02","kind":"measurement"},{"text":"When and by whom must this mapping be refreshed or removed?","id":"mapping-grant-and-reachability-q03","kind":"action"}]}]}]},{"id":"relay-and-path-selection","name":"Relay and path selection","description":"Manage intermediary forwarding and choose among usable paths.","layers":[{"id":"relay-readiness","name":"Relay readiness","description":"Track the resources and permissions required for relay forwarding.","findings":[{"id":"relay-allocation","name":"Relay allocation","description":"Record the relay service, allocation lifetime, supported transport and permission state required by the selected mechanism.","questions":[{"text":"Which relay allocation and peer permissions are active, and what evidence confirms forwarding works?","id":"relay-allocation-q01","kind":"measurement"},{"text":"Which authentication, capacity or transport limitation could prevent using or refreshing the allocation?","id":"relay-allocation-q02","kind":"boundary"}]}]},{"id":"path-choice","name":"Path choice","description":"Compare validated paths against communication requirements and operating policy.","findings":[{"id":"selection-and-fallback","name":"Selection and fallback","description":"Make the selected path and the conditions for switching explicit.","questions":[{"text":"Which validated path satisfies the required latency, throughput, privacy and relay-cost constraints?","id":"selection-and-fallback-q01","kind":"measurement"},{"text":"What observed failure or degradation should trigger fallback, renewed checks or session termination?","id":"selection-and-fallback-q02","kind":"action"}]}]}]},{"id":"continuity-and-controlled-exposure","name":"Continuity and controlled exposure","description":"Maintain usable paths while controlling the reachability and resources that traversal creates.","layers":[{"id":"path-lifecycle","name":"Path lifecycle","description":"Track freshness, refresh operations and invalidating network changes.","findings":[{"id":"expiry-and-rebinding","name":"Expiry and rebinding","description":"Distinguish keeping translation state alive from proving that the peer and application path remain usable.","questions":[{"text":"What measured or granted lifetime supports the current keepalive or refresh interval?","id":"expiry-and-rebinding-q01","kind":"measurement"},{"text":"Which interface change, address rebinding or failed exchange requires candidate rediscovery and path revalidation?","id":"expiry-and-rebinding-q02","kind":"action"},{"text":"Does the latest evidence demonstrate mapping persistence, peer responsiveness or successful application traffic?","id":"expiry-and-rebinding-q03","kind":"boundary"}]}]},{"id":"permission-and-teardown","name":"Permission and teardown","description":"Bound traversal actions by authority, peer consent and resource lifetime.","findings":[{"id":"authorised-reachability","name":"Authorised reachability","description":"Record permission to create reachability, disclose candidate addresses and continue sending traffic, together with cleanup obligations.","questions":[{"text":"What authority permits these probes, mapping requests, candidate disclosures and relay usage?","id":"authorised-reachability-q01","kind":"provenance"},{"text":"How is continued peer consent established where required by the traversal protocol?","id":"authorised-reachability-q02","kind":"measurement"},{"text":"Which mappings, allocations and credentials must be retired when the attempt ends or permission is withdrawn?","id":"authorised-reachability-q03","kind":"action"}]}]}]},{"id":"evidence-and-external-alignment","name":"Evidence and external alignment","description":"What the world already says about this thing, gathered so the model can be checked against it.","layers":[{"id":"reported-evidence","name":"Reported evidence","description":"Findings from the breadth pass, kept separate from the structural claims.","findings":[{"id":"evidence-confidence-notes","name":"Check these first","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these check these first hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-confidence-notes-q01","kind":"provenance"}]},{"id":"evidence-kinds","name":"Kinds and varieties","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these kinds and varieties hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-kinds-q01","kind":"provenance"}]},{"id":"evidence-standards-and-regulation","name":"Standards and regulation","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these standards and regulation hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-standards-and-regulation-q01","kind":"provenance"}]},{"id":"evidence-real-world-use","name":"Real-world use","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these real-world use hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-real-world-use-q01","kind":"provenance"}]},{"id":"evidence-failure-modes-and-hazards","name":"Failure modes and hazards","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these failure modes and hazards hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-failure-modes-and-hazards-q01","kind":"provenance"}]},{"id":"evidence-neighbours","name":"Neighbouring kinds and how to tell them apart","description":"Recalled without web access and unsourced; every item is a lead to verify.","questions":[{"text":"Which of these neighbouring kinds and how to tell them apart hold for the sense of NAT traversal this model covers, and on what evidence?","id":"evidence-neighbours-q01","kind":"provenance"}]}]}]}]},"agentConduct":{"may":["Explain how NAT traversal works in general terms and cite the relevant open standards.","Configure NAT traversal on networks and applications the agent is authorized to manage.","Diagnose connection failures caused by address translation for the system's operator."],"mustNot":["Use traversal to reach devices or networks it is not authorized to access.","Open inbound paths through a firewall that bypass an organization's security policy without its approval.","Expose the private addresses of users in peer-to-peer sessions without their knowledge.","Use relays to tunnel traffic around monitoring that the network owner requires."],"requiresHuman":["Enabling automatic port mapping or relays on a shared or corporate network."]},"ethics":{"considerations":["Traversal can make private devices reachable from the internet, which helps and harms.","Peer connections can leak a user's network address and approximate location."],"affectedParties":["Network users","Network administrators","Owners of exposed devices"]},"owners":{"steward":"The operator of the network and of each application that uses traversal.","roles":[],"masterSystems":[]},"relations":[{"target":"Q2695280","type":"parent","note":"registry parent class"}],"interaction":{"identity":{"applicability":"required","items":["Vercy registry: vr.tr.nat-traversal","Wikidata: Q581558 (https://www.wikidata.org/wiki/Q581558)"]},"properties":{"applicability":"not-applicable","items":["Traversal mechanism: connectivity-check-driven direct traversal | explicit mapping | relay | combination | unknown","Endpoint transport context: local endpoint, intended peer, transport protocol and address family","Translation topology: single translation boundary | multiple boundaries | no boundary observed | unknown; recorded separately for each endpoint","Observed mapping and filtering behaviour: separate observations of address-and-port mapping reuse and inbound acceptance across tested remote endpoints, with untested cases marked unknown","Candidate provenance: transport address linked to its discovery method, observing service or peer, interface and timestamp","Connectivity state: unattempted | discovering | checking | usable-direct | usable-relayed | degraded | failed | expired","Path validation age: seconds since the last successful validation of the selected path","Mapping or allocation lifetime: seconds, labelled as granted, experimentally observed, estimated or unknown","Selected-path performance: round-trip time in milliseconds, packet loss in percent and measured throughput in bits per second, each with an observation window","Traversal authority: attempt linked to permitted peers, services, mapping operations and network policy"]},"recognition":{"applicability":"not-applicable","items":[]},"capabilities":{"applicability":"required","items":["Gather candidate addresses and preserve the context and age of each observation.","Coordinate permitted connectivity checks between participating endpoints.","Request and later remove an authorised explicit mapping where supported.","Select a validated direct or relay path against application requirements and policy.","Refresh, revalidate or replace a path after inactivity or network change.","Diagnose failed attempts and release mappings, relay allocations and temporary credentials."]},"hazards":{"applicability":"required","items":["Incompatible gateway behavior or expired address mappings can prevent connection establishment or interrupt active sessions.","Traversal arrangements that conflict with access policy can expose services to unintended external communication.","Relayed traffic can introduce additional latency, operating costs and dependence on third-party infrastructure.","Connection metadata can reveal network addresses or communication relationships beyond the intended audience."]},"interfaces":{"applicability":"required","items":["Session Traversal Utilities for NAT (STUN), RFC 8489, Internet Engineering Task Force.","Traversal Using Relays around NAT (TURN), RFC 8656, Internet Engineering Task Force.","Interactive Connectivity Establishment (ICE), RFC 8445, Internet Engineering Task Force."]},"context":{"applicability":"required","items":["NAT traversal is used when devices behind address-translating gateways need to communicate with endpoints outside their local networks.","It supports applications such as voice calls, video meetings, multiplayer sessions and remote device communication.","Networking software may establish a direct path or use a relay according to gateway behavior and network policy."]}},"sources":[{"title":"Wikidata item Q581558: NAT traversal","url":"https://www.wikidata.org/wiki/Q581558","note":"identity and sense of the item"},{"title":"Wikipedia: NAT traversal","url":"https://en.wikipedia.org/wiki/NAT_traversal","note":"general description of the item"}],"openQuestions":["Should the registry boundary include application-specific NAT traversal adaptations such as IPsec NAT traversal, or represent them as specialised models linked to this one?","Which protocol specifications and versions should define the supported profiles for ICE, STUN, TURN and explicit gateway mapping?","What minimum observations justify classifying mapping and filtering behaviour without overgeneralising across destinations, transports or time?","What application-specific evidence and observation window should qualify a path as usable, degraded or failed?","Which deployment policies determine permitted address disclosure, explicit inbound exposure, relay selection and refresh traffic?"],"resources":{"spec":"/models/things/publications/thing-q581558/spec.json"},"provenance":{"origin":"thing registry research (pass 2)","builtFrom":["models/things/publications/thing-q581558/spec.json"],"providers":["Codex"],"researchStatus":"unreviewed","generatedAt":"2026-09-12T11:31:38Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"not-applicable","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"filled","interaction.context":"filled","sources":"filled"},"notes":{"_gate":"Published through the thing publication gate 1.0 on 2026-10-07T10:10:31+00:00: completeness 1.00; sense: Wikidata description; 2 live sources; review by codex: pass","interaction.properties":"Plane ACT: no invented physical properties.","interaction.recognition":"NAT traversal is a networking technique without a directly perceivable appearance."},"score":1.0}}