stun
STUN / TURN / ICE Error Codes
Error codes carried in the STUN ERROR-CODE attribute, used by STUN, TURN, and ICE (WebRTC NAT traversal) responses to signal why a Binding, Allocation, or Refresh request failed.
14 codes
references rfc-editor.org/rfc/rfc8489rfc-editor.org/rfc/rfc8656iana.org/assignments/stun-parameters/stun-parameters.xhtml
4xx Client error 11 codes
- 400 Bad Request The request was malformed — the server could not understand the request due to a missing required attribute, an unknown but non-comprehension-required attribute in the request outside its scope, a message that is too short, or some other similar error.
- 401 Unauthorized The request did not contain the correct credentials to proceed, or a TURN Allocate request was received with no MESSAGE-INTEGRITY attribute. The client should retry the request with proper long-term-credential authentication.
- 403 Forbidden TURN: the request is valid but cannot be authorized, for example an Allocate request refused by administrative policy such as a permission or quota restriction.
- 420 Unknown Attribute The server received a STUN packet containing a comprehension-required attribute that it did not understand. The response includes an UNKNOWN-ATTRIBUTES attribute listing the unrecognized attribute types.
- 437 Allocation Mismatch TURN: a request was received by the server that does not match the 5-tuple of an existing allocation, or that attempts to create an allocation on a 5-tuple already in use — for example, a client retransmitting an Allocate after a previous one succeeded but the response was lost.
- 438 Stale Nonce The NONCE used by the client was no longer valid — the server's nonce has expired or rolled over. The response includes a fresh NONCE attribute, and the client should retry the request with it.
- 440 Address Family not Supported TURN: the server does not support the address family requested by the client in a REQUESTED-ADDRESS-FAMILY attribute, for example a client requesting an IPv6 relayed address from a server that only allocates IPv4.
- 441 Wrong Credentials TURN: the credentials in the request do not match those previously used to authenticate the 5-tuple, typically because the client's long-term-credential username or realm changed mid-session without establishing a new allocation.
- 442 Unsupported Transport Protocol TURN: the Allocate request asked for a transport protocol in the REQUESTED-TRANSPORT attribute that the server does not support for relaying, such as a value other than UDP.
- 486 Allocation Quota Reached TURN: the server is currently unable to create any more allocations for this username — the per-user allocation quota enforced by the server's administrative policy has been reached.
- 487 Role Conflict ICE: both agents in a connectivity check believe they are the controlling agent, or both believe they are controlled. Used to resolve ICE controlling/controlled role disputes during connectivity checks.
5xx Server error 2 codes
- 500 Server Error The server encountered an unexpected condition that prevented it from fulfilling an otherwise valid request. The client may wish to resend the request at a later time.
- 508 Insufficient Capacity TURN: the server is unable to carry out the Allocate request because it lacks resources — for example, its port range is exhausted — even though the request itself is valid and the client is authorized.