STUN (Session Traversal Utilities for NAT) is a standard that helps networked applications learn how they appear from outside a NAT device. A client sends a STUN request to a server, which returns the public-facing IP address and port, allowing the client to establish or maintain real-time connections such as voice, video, or peer-to-peer sessions.
In cyber security, STUN matters because its traffic is often legitimate and low-friction, making it attractive for abuse. Attackers can hide command-and-control, proxying, or beaconing inside protocol flows that look like ordinary NAT-traversal activity. Defenders should not treat STUN as suspicious by default, but they should look for unusual destinations, unexpected frequency, odd payload sizes, or hosts that should not be using real-time communication tools. Monitoring behavior, not just ports, is key.