SCTP does two things that I think are hugely important.
First, it provides a datagram/record transport that is TCP-friendly. The most important thing TCP does isn't reliability; it's the insanely complicated interpretive dance it performs with other TCPs to keep them from melting the network. Right now, your only scalable transport option is TCP, which means you're boned if you want real-time.
Second, it provides reliable out-of-order delivery, which is exactly the happy medium that I assert without evidence 99% of UDP apps actually need. Reliability good. Enforced ordered delivery bad; means updates lag behind stale data.
The big issue with SCTP is that firewalls will block it.
Meh. SYN floods are pretty much a solved problem. Try to take something behind an F5 offline, for the simplest example.
I agree that, on paper, it's a more useful protocol. Remember though that TCP is about the congestion control algorithm. The rest of what TCP does is trivial.
Not trying to shoot you down FWIW, just trying to dispel the myth of the TCP SYN flood. You'd be surprised how many otherwise very savvy clients ask us about them.
Not questioning the OP's intentions, but a remote vulnerability in most SCTP stacks was published last week: http://pastebin.com/m6863ef05 CVE-2009-0065
Its not every day you see remote code execution exploit of a Transport layer protocol, and what OS do you think people are going to be toying around with SCTP... Linux. This is serious.
Simply because a vulnerability in the transport layer results in every service relying on that protocol to be vulnerable? Are you saying that a remote code execution vulnerability in TCP would not be worse than one in for instance FTP?
(I am aware of your credentials so I'm trying to figure out what I'm missing, not trying to be snippy)
Ok. Fair point. TCP would be worse than FTP, because you could hit it from ports 21, 22, 80, and 443.
FTP would be far worse than SCTP, because you're much more likely to be using it.
I'll admit, my mind jumped immediately to "vulnerability in the kernel! much worse than vulnerability in a web server!", which is exactly the wrong way to think about the problem --- once you've conceded code execution to an attacker, you've conceded the box.
Maybe that wasn't his argument. Thanks for calling me out on that.
Either way, the Linux advisory he cited should have absolutely no impact on your consideration of SCTP.
"Since then, it has found its way into all major operating systems, including GNU/Linux, BSD, and Solaris. It's also available for the Microsoft® Windows® operating systems as a third-party commercial package."
I don't think that you can really exclude Windows from the category "major operating systems". It might not be your favorite operating system (it certainly isn't mine), but give the devil his due.
What would be really cool would be a sctp option for vnc. When you're working on a poor connection, it's really annoying when vnc becomes blocked waiting for some rectangle to be retransmitted, when it could perfectly well keep going updating the other rectangles.
If nothing else, it's possible to tunnel tcp over sctp. But you could write a webserver that delivered HTTP messages over sctp directly. In fact that would make a good research project for someone. And it would likely be useful, if only for the sheer amount of stuff that uses HTTP as a transport.
The thing is that as an asynchronous protocol HTTP doesn't get that much benefit from being delivered over sctp whereas protocols that depend on continuous session state like ssh or XMPP or VOIP streams would potentially gain much more.
I think it could be useful for a reverse proxy when talking with the backends. SCTP would be contained to your LAN traffic so adoption on the open internet & firewalls is a non-issue, and you get some benefits from avoiding head of line blocking. Possibly. Discuss below! :)
No. SCTP is good for applications that were designed to use SCTP. Practically the entire TCP/IP infrastructure we run today is already optimized for the HTTP case.
First, it provides a datagram/record transport that is TCP-friendly. The most important thing TCP does isn't reliability; it's the insanely complicated interpretive dance it performs with other TCPs to keep them from melting the network. Right now, your only scalable transport option is TCP, which means you're boned if you want real-time.
Second, it provides reliable out-of-order delivery, which is exactly the happy medium that I assert without evidence 99% of UDP apps actually need. Reliability good. Enforced ordered delivery bad; means updates lag behind stale data.
The big issue with SCTP is that firewalls will block it.