WebRTC & Real-Time Media: Signaling, STUN/TURN and SFUs

Why not just HTTP. Calls need low latency more than perfect delivery: a lost video frame is skipped, not resent. That is why media uses UDP (via SRTP) and why a late packet is worth less than a missing one. TCP's retransmission would add exactly the delay you are trying to avoid.

Signaling. Before two browsers can talk they must exchange: who is calling whom, which codecs each supports (an SDP offer/answer), and network addresses (ICE candidates). WebRTC does not define how; you build a signaling service, typically WebSocket-based. It carries tiny messages, is not on the media path, and is the part you must scale and secure yourself.

NAT is the real obstacle. Most devices sit behind routers with private addresses. ICE tries paths in order of cost: a direct local connection, then a STUN-discovered public address (the STUN server just says 'here is the address I see you at'), and finally TURN, a relay that forwards all media when no direct path exists (symmetric NATs, strict firewalls). TURN costs bandwidth, so plan for the share of calls that need it (often 10-20%).

Group calls: mesh vs MCU vs SFU. In a mesh, everyone connects to everyone: N-1 uploads per person, fine for 3-4, hopeless beyond that. An MCU decodes everyone and mixes one stream: easy for clients, but very CPU-heavy on the server. An SFU (selective forwarding unit) receives each participant's single upload and forwards it to the others without decoding: the standard for Zoom-like products.

Adapting to bad networks. Participants send simulcast (the same video at 3 qualities); the SFU forwards the layer each receiver can handle and switches as bandwidth changes. Congestion control lowers the bitrate before packets are dropped. This is why calls get blurry instead of freezing.

Scaling an SFU. One SFU handles a few hundred participants. Large meetings cascade SFUs (clients connect to the nearest one, which relays to others) and place servers close to users, because every extra 100 ms of distance is audible. A room is pinned to one or a few SFUs, so the control plane assigns rooms to servers.

Webinars vs meetings. Thousands of viewers and a few speakers are not a call: the speakers' streams go to an SFU, then to a CDN-style fan-out, accepting a few seconds of delay. Choose by interactivity: sub-second means WebRTC, a few seconds means HLS/DASH at CDN scale.

Recording and chat. Recording is a separate subscriber that joins the room and writes to object storage; chat and presence ride the signaling channel. Authenticate every join with a short-lived token.