title: Coturn/turnserver : error 437: Mismatched allocation: wrong transaction ID (WebRTC)
body: <p>I have this structure :</p>
  
  <ul>
  <li>Web server : Apache. it's in a LAN. It is on a pc (windows 7) which has public static ip. PC is in a network.</li>
  <li>Signal server: In a VM (VirtualBox Centos 6) on the same pc.</li>
  <li>STUN/TURN server : Coturn "4.5.0.4". In a VM (VirtualBox Centos 6) on the same pc.</li>
  <li>Client A : Laptop, Vista. I use a Samsung mobile and usb tethering to get (external) internet. The Mobile uses "mobile data" to connect to internet.</li>
  <li>Client B :Laptop, Windows 8(or Windows 10). I use a Samsung tablet and usb tethering to get (external) internet. The tablet uses "mobile data" to connect to internet.</li>
  </ul>
  
  <p>I run a coturn/turnserver like this:</p>
  
  <pre><code>sudo turnserver -X xxx.xx.xxx.xx (this is my static external ip)
  </code></pre>
  
  <p>I have created port forward:</p>
  
  <pre><code>3479 -&gt; 3478 for TCP
  3479 -&gt; 3478 for UTP
  5348 -&gt; 5349 for TCP
  5348 -&gt; 5349 for UTP
  </code></pre>
  
  <p>I use the default configuration file of coturn with these changes :</p>
  
  <pre><code>verbose
  fingerprint
  lt-cred-mech
  realm=mycompany.org
  cert=server.crt
  pkey=server.key
  pkey-pwd=.... (it has been omitted)
  log-file=/var/tmp/turnserver.log
  simple-log
  </code></pre>
  
  <p>I have created files server.crt and server.key and i know they are right because i can use the web admin tool which need them to run with https</p>
  
  <p>I have created admin user. I have created a key for user "test4" using :</p>
  
  <pre><code>sudo turnadmin -k -u test4 -r mycompany.org -p test
  </code></pre>
  
  <p>and i use it to create him :</p>
  
  <pre><code>sudo turnadmin -a -b "/var/db/turndb" -u test4 -r mycompamy.org -p ......
  </code></pre>
  
  <p>On client :</p>
  
  <pre><code>var STUN = {
      urls: "stun:xxx.xx.xxx.xx:3479" //port forward
  };
  
  var TURN = {
      urls: [
          "turn:xxx.xx.xxx.xx:3479?transport=udp", 
          "turn:xxx.xx.xxx.xx:3479?transport=tcp",
          "turn:xxx.xx.xxx.xx:3479"
      ], 
      username : "test4",
      credential : "......................", (it's the key. it has been omitted)
  };
  </code></pre>
  
  <p>The messages, I get from coturn/turnserver are like these :</p>
  
  <pre><code>242: handle_udp_packet: New UDP endpoint: local addr 10.0.2.15:3478, remote addr 10.0.2.2:60113
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  242: handle_udp_packet: New UDP endpoint: local addr 10.0.2.15:3478, remote addr 10.0.2.2:60075
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  242: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  243: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  243: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  243: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  243: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  243: IPv4. Local relay addr: 10.0.2.15:55037
  243: session 000000000000000003: new, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=600
  243: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  243: IPv4. Local relay addr: 10.0.2.15:52683
  243: session 000000000000000002: new, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=600
  243: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  243: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  243: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  243: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  243: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  244: session 000000000000000002: refreshed, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=0
  244: session 000000000000000002: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet REFRESH processed, success
  244: session 000000000000000003: refreshed, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=0
  244: session 000000000000000003: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet REFRESH processed, success
  245: session 000000000000000002: closed (2nd stage), user &lt;test4&gt; realm &lt;mycompany.org&gt; origin &lt;&gt;, local 10.0.2.15:3478, remote 10.0.2.2:60113, reason: allocation timeout
  245: session 000000000000000002: delete: realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;
  245: session 000000000000000003: closed (2nd stage), user &lt;test4&gt; realm &lt;mycompany.org&gt; origin &lt;&gt;, local 10.0.2.15:3478, remote 10.0.2.2:60075, reason: allocation timeout
  245: session 000000000000000003: delete: realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;
  </code></pre>
  
  <p>What am I missing here ? Why do I get "ICE failed" in console ?</p>
  
  <p>I read in <a href="https://tools.ietf.org/id/draft-ietf-behave-turn-08.html" rel="nofollow">https://tools.ietf.org/id/draft-ietf-behave-turn-08.html</a>
  about </p>
  
  <pre><code>"error 437: Mismatched allocation: wrong transaction ID"
  </code></pre>
  
  <p>it says</p>
  
  <blockquote>
    <p>437 (Allocation Mismatch): This indicates that the client has picked a
    5-tuple which the server sees as already in use or which was recently
    in use. One way this could happen is if an intervening NAT assigned a
    mapped transport address that was recently used by another allocation.
    The client SHOULD pick another client transport address and retry the
    Allocate request (using a different transaction id). The client SHOULD
    try three different client transport addresses before giving up on
    this server. Once the client gives up on the server, it SHOULD NOT try
    to create another allocation on the server for 2 minutes.</p>
  </blockquote>
  
  <p>What does this mean? </p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Now, when client A uses Chrome "49.02623.112 m" (I can't update it anymore because is on Vista) and client B "50.0.2661.75 m" the coturn server works fine for a few seconds. I run the server like this( I am not sure if this helps. XXX.XX.XXX.XX is the public static IP of the PC where the VM of the server lives and 192.168.2.190 is the internal IP) :</p>
  
  <pre><code>sudo turnserver -X XXX.XX.XXX.XX/192.168.2.190
  </code></pre>
  
  <p>These are the log messages:</p>
  
  <pre><code>0: log file opened: /var/log/turn_3205_2016-04-15.log
  0:
  RFC 3489/5389/5766/5780/6062/6156 STUN/TURN Server
  Version Coturn-4.5.0.4 'dan Eider'
  0:
  Max number of open files/sockets allowed for this process: 4096
  0:
  Due to the open files/sockets limitation,
  max supported number of TURN Sessions possible is: 2000 (approximately)
  0:
  
  ==== Show him the instruments, Practical Frost: ====
  
  0: TLS supported
  0: DTLS supported
  0: DTLS 1.2 is not supported
  0: TURN/STUN ALPN is not supported
  0: Third-party authorization (oAuth) supported
  0: GCM (AEAD) supported
  0: OpenSSL compile-time version: OpenSSL 1.0.1e-fips 11 Feb 2013
  0:
  0: SQLite supported, default database location is /var/db/turndb
  0: Redis supported
  0: PostgreSQL supported
  0: MySQL supported
  0: MongoDB is not supported
  0:
  0: Default Net Engine version: 3 (UDP thread per CPU core)
  
  =====================================================
  
  0: Config file found: /etc/turnserver/turnserver.conf
  0: log file opened: /var/tmp/turnserver.log
  0: Config file found: /etc/turnserver/turnserver.conf
  0: Domain name:
  0: Default realm: mycompany.org
  0: Config file found: /etc/turnserver/server.crt
  0: Config file found: /etc/turnserver/server.key
  0: SSL23: Certificate file found: /etc/turnserver/server.crt
  0: SSL23: Private key file found: /etc/turnserver/server.key
  0: TLS1.0: Certificate file found: /etc/turnserver/server.crt
  0: TLS1.0: Private key file found: /etc/turnserver/server.key
  0: TLS1.1: Certificate file found: /etc/turnserver/server.crt
  0: TLS1.1: Private key file found: /etc/turnserver/server.key
  0: TLS1.2: Certificate file found: /etc/turnserver/server.crt
  0: TLS1.2: Private key file found: /etc/turnserver/server.key
  0: TLS cipher suite: DEFAULT
  0: DTLS: Certificate file found: /etc/turnserver/server.crt
  0: DTLS: Private key file found: /etc/turnserver/server.key
  0: DTLS cipher suite: DEFAULT
  0: NO EXPLICIT LISTENER ADDRESS(ES) ARE CONFIGURED
  0: ===========Discovering listener addresses: =========
  0: Listener address to use: 127.0.0.1
  0: Listener address to use: 10.0.2.15
  0: Listener address to use: ::1
  0: =====================================================
  0: Total: 1 'real' addresses discovered
  0: =====================================================
  0: NO EXPLICIT RELAY ADDRESS(ES) ARE CONFIGURED
  0: ===========Discovering relay addresses: =============
  0: Relay address to use: 10.0.2.15
  0: Relay address to use: ::1
  0: =====================================================
  0: Total: 2 relay addresses discovered
  0: =====================================================
  0: pid file created: /var/run/turnserver.pid
  0: IO method (main listener thread): epoll (with changelist)
  0: Wait for relay ports initialization...
  0:   relay 10.0.2.15 initialization...
  0:   relay 10.0.2.15 initialization done
  0:   relay ::1 initialization...
  0:   relay ::1 initialization done
  0: Relay ports initialization done
  0: IO method (general relay thread): epoll (with changelist)
  0: turn server id=1 created
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: IO method (general relay thread): epoll (with changelist)
  0: turn server id=0 created
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: Cannot create TLS listener
  0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:3478
  0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:3479
  0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:5349
  0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:5350
  0: IPv4. DTLS/UDP listener opened on: 10.0.2.15:3478
  0: IPv4. DTLS/UDP listener opened on: 10.0.2.15:3479
  0: IPv4. DTLS/UDP listener opened on: 10.0.2.15:5349
  0: IPv4. DTLS/UDP listener opened on: 10.0.2.15:5350
  0: IPv6. DTLS/UDP listener opened on: ::1:3478
  0: IPv6. DTLS/UDP listener opened on: ::1:3479
  0: IPv6. DTLS/UDP listener opened on: ::1:5349
  0: IPv6. DTLS/UDP listener opened on: ::1:5350
  0: Total General servers: 2
  0: IO method (admin thread): epoll (with changelist)
  0: ERROR: Cannot create CLI listener
  0: IO method (auth thread): epoll (with changelist)
  0: IO method (auth thread): epoll (with changelist)
  0: SQLite DB connection success: /var/db/turndb
  1275: handle_udp_packet: New UDP endpoint: local addr 10.0.2.15:3478, remote addr 10.0.2.2:30637
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  1275: handle_udp_packet: New UDP endpoint: local addr 10.0.2.15:3478, remote addr 10.0.2.2:30638
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet BINDING processed, success
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;&gt;: incoming packet message processed, error 401: Unauthorized
  1275: IPv4. Local relay addr: 10.0.2.15:52828
  1275: session 001000000000000001: new, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=600
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  1275: IPv4. Local relay addr: 10.0.2.15:57360
  1275: session 000000000000000001: new, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=600
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  1275: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  1275: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet ALLOCATE processed, success
  1276: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1276: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1276: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1276: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1277: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1277: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1278: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1278: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1280: session 001000000000000001: refreshed, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=0
  1280: session 001000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet REFRESH processed, success
  1280: session 000000000000000001: peer XXX.XX.XX.XX lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer XXX.XX.XX.XX lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer 10.0.2.2 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer 10.0.2.15 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1280: session 000000000000000001: peer 10.0.2.2 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer 10.0.2.15 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer 10.0.2.15 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1280: session 000000000000000001: peer 10.0.2.15 lifetime updated: 300
  1280: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CREATE_PERMISSION processed, success
  1281: session 001000000000000001: closed (2nd stage), user &lt;test4&gt; realm &lt;mycompany.org&gt; origin &lt;&gt;, local 10.0.2.15:3478, remote 10.0.2.2:30638, reason: allocation timeout
  1281: session 001000000000000001: delete: realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;
  1281: session 000000000000000001: peer 10.0.2.15 lifetime updated: 600
  1281: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CHANNEL_BIND processed, success
  1282: session 000000000000000001: peer 10.0.2.15 lifetime updated: 600
  1282: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet CHANNEL_BIND processed, success
  1282: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1283: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet message processed, error 437: Mismatched allocation: wrong transaction ID
  1285: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet BINDING processed, success
  1286: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet BINDING processed, success
  1286: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet BINDING processed, success
  1292: session 000000000000000001: refreshed, realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;, lifetime=0
  1292: session 000000000000000001: realm &lt;mycompany.org&gt; user &lt;test4&gt;: incoming packet REFRESH processed, success
  1293: session 000000000000000001: closed (2nd stage), user &lt;test4&gt; realm &lt;mycompany.org&gt; origin &lt;&gt;, local 10.0.2.15:3478, remote 10.0.2.2:30637, reason: allocation timeout
  1293: session 000000000000000001: delete: realm=&lt;mycompany.org&gt;, username=&lt;test4&gt;
  1293: session 000000000000000001: peer XXX.XX.XX.XX deleted
  1293: session 000000000000000001: peer 10.0.2.2 deleted
  1293: session 000000000000000001: peer 10.0.2.15 deleted
  </code></pre>