View source for Middlebox

=== Application interference ===
Some middleboxes interfere with application functionality, restricting or preventing end host applications from performing properly.

In particular, network address translators (NATs) present a challenge in that NAT devices divide traffic destined to a public IP address across several receivers. When connections between a host on the Internet and a host behind the NAT are initiated by the host behind the NAT, the NAT learns that traffic for that connection belongs to the local host. Thus, when traffic coming from the Internet is destined to the public (shared) address on a particular [[Port (computer networking)|port]], the NAT can direct the traffic to the appropriate host. However, connections initiated by a host on the Internet do not present the NAT any opportunity to "learn" which internal host the connection belongs to. Moreover, the internal host itself may not even know its own public IP address to announce to potential clients what address to connect to. To resolve this issue, several new protocols have been proposed.<ref name=stun /><ref name=natpmp /><ref name=pcp />

Additionally, because middlebox deployments by cell operators such as [[AT&T]] and [[T-Mobile US|T-Mobile]] are opaque, application developers are often "unaware of the middlebox policies enforced by operators", while operators lack full knowledge about application behavior and requirements. For example, one carrier set an "aggressive [[Timeout (computing)|timeout]] value to quickly recycle the resources held by inactive [[Transmission Control Protocol|TCP]] connections in the firewall, unexpectedly causing frequent disruptions to long-lived and occasionally idle connections maintained by applications such as [[Push email|push-based email]] and [[instant messaging]]".<ref name="cells"/>

Other common middlebox-induced application challenges include [[Proxy server|web proxies]] serving "stale" or out-of-date content,<ref name=staleproxy /> and firewalls rejecting traffic on desired ports.<ref name=firewallblock />