Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Secure Socket Tunneling Protocol
open-in-new
<h2 id="protocol">Protocol</h2> <p>SSL/TLS provides transport-level security with key negotiation, <a href="/facts/Encryption/16q29Fdv">encryption</a> and traffic integrity checking. The use of SSL/TLS over <a href="/facts/Transmission_Control_Protocol/WW4sPrt9">TCP</a> port 443 (by default; port can be changed) allows SSTP to pass through virtually all <a href="/facts/Firewall_(computing)/Et2RkJaU">firewalls</a> and <a href="/facts/Proxy_server/ArhwQE74">proxy servers</a> except for authenticated web proxies.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a> </p><p>SSTP servers must be <a href="/facts/Authentication/64y4S69b">authenticated</a> during the SSL/TLS phase. SSTP clients can optionally be authenticated during the SSL/TLS phase and must be authenticated in the PPP phase. The use of PPP allows support for common authentication methods, such as <a href="/facts/EAP-TLS/yuCAFHxC">EAP-TLS</a> and <a href="/facts/MS-CHAP/ngj5echo">MS-CHAP</a>. </p><p>SSTP is available for <a href="/facts/Linux/9FvCKSTq">Linux</a>, <a href="/facts/BSD/XQKcURrh">BSD</a>, and <a href="/facts/Windows/bwhAhuSL">Windows</a>.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> </p><p>SSTP was introduced in 2007<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a> and available on <a href="/facts/Windows_Vista_SP1/IASEUCTB">Windows Vista SP1</a> and later, in <a href="/facts/MikroTik/7TlAoXby">RouterOS</a> since version 5.0, and in <a href="/facts/IIJ_SEIL/P8MJzv2z">SEIL</a> since its firmware version 3.50. It is fully integrated with the RRAS architecture in these operating systems, allowing its use with <a href="/facts/Winlogon/AACjUHLY">Winlogon</a> or <a href="/facts/Smart-card/K7b9lowS">smart-card</a> authentication, remote-access policies and the Windows VPN client.<a class="footnote-ref" id="fnref:4" href="#fn:4"><sup>4</sup></a> The protocol is also used by <a href="/facts/Windows_Azure/CCnIHTHd">Windows Azure</a> for Point-to-Site Virtual Network.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a> </p><p>SSTP is intended only for remote client access, it generally does not support site-to-site VPN tunnels.<a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> </p><p>SSTP suffers from the same performance limitations as any other IP-over-TCP tunnel. In general, performance will be acceptable only as long as there is sufficient excess bandwidth on the un-tunneled network link to guarantee that the tunneled TCP timers do not expire. If this becomes untrue, performance falls off dramatically due to the <a href="/facts/TCP_meltdown_problem/jKaT1Czc">TCP meltdown problem</a>.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a><a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a> </p><p>SSTP supports user authentication only; it does not support device authentication or computer authentication. </p> <h2 id="packet-structure">Packet structure</h2> <p>The following header structure is common to all types of SSTP packets:<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a> </p> SSTP header<table><tbody><tr><th>Bit offset</th><th colspan="8">Bits 0–7</th><th colspan="7">8–14</th><th>15</th><th colspan="16">16–31</th></tr><tr><th>0</th><td colspan="8">Version</td><td colspan="7">Reserved</td><td colspan="1">C</td><td colspan="16">Length</td></tr><tr><th>32+</th><td colspan="32">Data</td></tr></tbody></table> <ul><li>Version (8 bits) – communicates and negotiates the version of SSTP that is used.</li> <li>Reserved (7 bits) – reserved for future use.</li> <li>C (1 bit) – control bit indicating whether the SSTP packet represents an SSTP control packet or an SSTP data packet. This bit is set if the SSTP packet is a control packet.</li> <li>Length (16 bits) – packet length field, composed of two values: a Reserved portion and a Length portion.</li></ul> <ul><li>Reserved (4 bits) – reserved for future use.</li> <li>Length (12 bits) – contains the length of the entire SSTP packet, including the SSTP header.</li></ul> <ul><li>Data (variable) – when control bit C is set, this field contains an SSTP control message. Otherwise, the data field would contain a higher-level protocol. At the moment, this can only be <a href="/facts/Point-to-Point_Protocol/XLaU6D71">PPP</a>.</li></ul> <h3>Control message</h3> <p>The data field of the SSTP header contains an SSTP control message only when the header's Control bit C is set. </p> SSTP control message<table><tbody><tr><th>Bit offset</th><th colspan="16">Bits 0–15</th><th colspan="16">16–31</th></tr><tr><th>0</th><td colspan="16">Message type</td><td colspan="16">Attributes count</td></tr><tr><th>32+</th><td colspan="32">Attributes</td></tr></tbody></table> <ul><li>Message type (16 bits) – specifies the type of SSTP control message being communicated. This dictates the number and types of attributes that can be carried in the SSTP control packet.</li> <li>Attributes count (16 bits) – specifies the number of attributes appended to the SSTP control message.</li> <li>Attributes (variable) – contains a list of attributes associated with the SSTP control message. The number of attributes is specified by the Attributes count field.</li></ul> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/AuthIP/GX0C3xEN">AuthIP</a></li> <li><a href="/facts/L2TP/50sRGptx">L2TP/IPsec</a></li> <li><a href="/facts/HTTPS/MSWYz4zo">HTTPS</a></li> <li><a href="/facts/OpenVPN/p8qllSrP">OpenVPN</a></li> <li><a href="/facts/OpenConnect/NAJeM3Vu">OpenConnect VPN</a></li> <li><a href="/facts/PPTP/jYb3uG0Y">PPTP</a></li> <li><a href="/facts/SoftEther_VPN/pDQLxGlK">SoftEther VPN</a>, an open-source VPN server program which supports SSTP-VPN protocol.</li> <li><a href="/facts/WireGuard/zSJv87LA">WireGuard</a></li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/c50ed240-56f3-4309-8e0c-1644898f0ea8">[MS-SSTP]: Secure Socket Tunneling Protocol (SSTP)</a> by <a href="/facts/Microsoft_Open_Specification_Promise/suyEKAKf">Microsoft Open Specification Promise</a></li> <li><a href="http://blogs.technet.com/rrasblog/archive/tags/SSTP/default.aspx">RRAS Technet Blog</a></li> <li><a href="http://www.techworld.com/networking/news/index.cfm?newsID=7814&pagtype=all">Microsoft develops new tunneling protocol</a></li> <li><a href="https://blogs.technet.microsoft.com/rrasblog/2007/01/10/how-sstp-based-vpn-connection-works/">How SSTP based VPN connection works</a></li> <li><a href="http://www.hsc.fr/ressources/outils/sstoper/index.html.en">HSC's SSTP Client for Linux</a></li> <li><a href="http://sstp-client.sourceforge.net/">SSTP Client for Linux</a></li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Jain, Samir (2007-01-17). "SSTP FAQ - Part 2: Client Specific". Microsoft TechNet. Retrieved 2015-10-17. <a href="http://blogs.technet.com/b/rrasblog/archive/2007/01/17/sstp-faq-part-2-client-specific.aspx" target="_blank">http://blogs.technet.com/b/rrasblog/archive/2007/01/17/sstp-faq-part-2-client-specific.aspx</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"SSTP-Client". 2011-09-17. Retrieved 2015-10-17. <a href="http://sstp-client.sourceforge.net/" target="_blank">http://sstp-client.sourceforge.net/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> <li id="fn:3"><p>"[MS-SSTP]: Secure Socket Tunneling Protocol (SSTP)". learn.microsoft.com. 2022-11-04. Retrieved 2024-08-30. <a href="https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/c50ed240-56f3-4309-8e0c-1644898f0ea8" target="_blank">https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-sstp/c50ed240-56f3-4309-8e0c-1644898f0ea8</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li> <li id="fn:4"><p>Tulloch, Mitch (2008-01-22). "SSTP Makes Secure Remote Access Easier". Retrieved 2015-10-17. <a href="http://www.biztechmagazine.com/article/2008/01/sstp-makes-secure-remote-access-easier" target="_blank">http://www.biztechmagazine.com/article/2008/01/sstp-makes-secure-remote-access-easier</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li> <li id="fn:5"><p>McGuire, Cheryl (2015-08-11). "Configure a point-to-site VPN connection to an Azure Virtual Network". Retrieved 2015-10-17. <a href="https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-point-to-site-create/" target="_blank">https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-point-to-site-create/</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li> <li id="fn:6"><p>Jain, Samir (2007-01-10). "SSTP FAQ - Part 1: Generic". TechNet Blogs. Archived from the original on 2010-10-12. <a href="https://web.archive.org/web/20101012205841/http://blogs.technet.com/b/rrasblog/archive/2007/01/10/sstp-faq-part-1-generic.aspx" target="_blank">https://web.archive.org/web/20101012205841/http://blogs.technet.com/b/rrasblog/archive/2007/01/10/sstp-faq-part-1-generic.aspx</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li> <li id="fn:7"><p>Titz, Olaf (2001-04-23). "Why TCP Over TCP Is A Bad Idea". Retrieved 2015-10-17. <a href="http://sites.inka.de/bigred/devel/tcp-tcp.html" target="_blank">http://sites.inka.de/bigred/devel/tcp-tcp.html</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li> <li id="fn:8"><p>Honda, Osamu; Ohsaki, Hiroyuki; Imase, Makoto; Ishizuka, Mika; Murayama, Junichi (October 2005). "Understanding TCP over TCP: effects of TCP tunneling on end-to-end throughput and latency". In Atiquzzaman, Mohammed; Balandin, Sergey I (eds.). Performance, Quality of Service, and Control of Next-Generation Communication and Sensor Networks III. Vol. 6011. p. 60110H. Bibcode:2005SPIE.6011..138H. doi:10.1117/12.630496. S2CID 8945952. <a href="/wiki/Bibcode_(identifier)" target="_blank">/wiki/Bibcode_(identifier)</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li> <li id="fn:9"><p>"MS-SSTP: Secure Socket Tunneling Protocol (SSTP)". Microsoft TechNet. 2015-10-16. Retrieved 2015-10-17. <a href="https://technet.microsoft.com/en-us/subscriptions/cc247338.aspx" target="_blank">https://technet.microsoft.com/en-us/subscriptions/cc247338.aspx</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li> </ol>