Secure Socket Tunneling Protocol

Not to be confused with Simple Symmetric Transport Protocol.

Secure Socket Tunneling Protocol (SSTP) is a form of VPN tunnel that provides a mechanism to transport PPP or L2TP traffic through an SSL 3.0 channel. SSL provides transport-level security with key-negotiation, encryption and traffic integrity checking. The use of SSL over TCP port 443 allows SSTP to pass through virtually all firewalls and proxy servers.

SSTP servers must be authenticated during the SSL phase. SSTP clients can optionally be authenticated during the SSL phase, and must be authenticated in the PPP phase. The use of PPP allows support for common authentication methods, such as EAP-TLS and MS-CHAP.

SSTP is only available in Windows since version Windows Vista SP1, in RouterOS, and in SEIL since its firmware version 3.50. It is fully integrated with the RRAS architecture in these operating systems, allowing its use with Winlogon or smart card authentication, remote access policies and the Windows VPN client.[1]

SSTP is only for remote client access, it does not support site-to-site VPN tunnels.[2]

SSTP suffers from the same performance limitations as any other IP-over-TCP tunnel. In general, performance will be acceptable only as long as there is sufficient excess bandwidth on the un-tunneled network link to guarantee that the tunneled TCP timers do not expire. If this becomes untrue, performance falls off dramatically. This is known as the "TCP meltdown problem" [3][4]

Contents

Packet Structure

Header

The following header structure is common to all types of SSTP packets:

SSTP Header
Bit offset Bits 0–7 8–14 15 16–31
0 Version Reserved C Length
32+  
Data
 
  • Reserved (4 bits) – Reserved for future use.
  • Length (12 bits) – Contains the length of the entire SSTP packet, including the SSTP header.

Control Message

The data field of the SSTP header contains an SSTP control message only when the header's Control bit C is set.

SSTP Control Message
Bit offset Bits 0–15 16–31
0 Message Type Attributes Count
32+  
Attributes
 

See also

References

  1. ^ SSTP Makes Secure Remote Access Easier
  2. ^ SSTP FAQ
  3. ^ Why TCP Over TCP Is A Bad Idea
  4. ^ Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency

External links