A transaction ID is the matching value STUN uses to pair a request with its response. In normal traffic, the client creates a unique identifier, the server copies it back, and both sides use it to track one exchange among many concurrent packets. Because STUN often runs over UDP, this field is important for keeping replies tied to the right session.
In cyber security, transaction IDs matter because attackers can abuse them as a low-profile signaling channel. Malware may choose specific values, repeat patterns, or vary the field in a way that carries data while the surrounding packets still look like ordinary STUN. Defenders can look for IDs that are too regular, reused across unrelated flows, or inconsistent with expected request-response behavior. Baselines, protocol-aware inspection, and correlation of UDP flows help separate normal traversal traffic from covert control messages.