Every server-reflexive address is one the STUN server actually handed out
Every srflx address the page reports is one the audit's STUN server received a binding request from. N/A when no srflx is gathered or the server's lookup does not answer (severity: warn).
What a detector infers
A server-reflexive candidate exists only after a STUN server received a binding request from that public address and replied with it. That gives every reflexive address two witnesses: the page that reports it, and the server that handed it out. This row asks the second one.
The audit's STUN server logs binding requests by source address, and each srflx address the page reports is looked up there; if the server never heard from that address, the candidate was not learned from it. In testing against a logging STUN server, every one of eleven arms — stock browsers and automation frameworks alike — sent exactly one binding request for each srflx it reported.
A candidate list carrying a configured public address to which no request was ever sent is the failing shape, and it is the kind of substitution that otherwise looks plausible, because the address itself is real and routable. There is essentially no room for a false positive: a browser can only learn a mapped address from a server that sent it.
This row is stronger than srflx-only-from-answering-stun, because it also catches a srflx produced while a real, answering server was configured.
How to resolve it
Use a real STUN exchange: let the browser send its binding request from the address that should appear, so the server sees it and returns it. An address written into the candidate list never reaches the server that is supposed to have reported it.
Nearby checks in Network & WebRTC
- navigator.connection.downlink sits on Chrome's 50 kbps grid, capped at 10
downlink-on-50kbps-gridnavigator.connection.downlink is not a raw measurement. Blink's NetworkStateNotifier multiplies the network-quality estimate by a per-host… - A server-reflexive candidate only appears when a STUN server answered
srflx-only-from-answering-stunA server-reflexive (srflx) ICE candidate is the public address a STUN server reports back in its reply to a binding request. - Emoji come from the claimed OS's emoji font
emoji-font-vs-osEmoji are drawn from the operating system's colour emoji font, and the fonts differ in a way measureText can see without rendering a pixel. - Canvas text is anti-aliased the way the claimed OS rasterises it
glyph-aa-levels-vs-osCanvas text is rasterised by the platform's font engine, and the engines leave different fingerprints in the alpha channel. - The default monospace font is the claimed OS's
monospace-default-vs-osThe generic monospace family resolves to a font the platform chooses. - The JS heap ceiling fits the memory the browser reports
heap-ceiling-vs-device-memorynavigator.deviceMemory and V8's heap ceiling, performance.memory.jsHeapSizeLimit, look unrelated but are computed from the same number: the… - The address WebRTC exits from matches the address this page was served to
webrtc-ip-vs-connectionThis is the one check on this page that cannot be answered from inside the page, and the only one that makes a network call. - Relay-forced WebRTC exits the same address this page arrived from
webrtc-turn-egressEvery other WebRTC check on this page reads what the browser is willing to show it.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Network & WebRTC checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Network & WebRTC — the family srflx-was-seen-by-stun belongs to.