Ports, endpoints, timings, and limits.
| Port | Protocol | Direction | Purpose |
|---|---|---|---|
26431 | TCP | Inbound (listen) | Peer connections to you. Default; configurable. |
26432 | TCP | Outbound | Your connections to the peer. Default; configurable. |
26000-27000 | TCP | - | The valid range for peer ports. The handshake and the relay reject ports outside it. |
26999 | UDP | Multicast | LAN discovery, group 224.0.0.167. IPv4 only. |
26600 | TCP | Outbound only | The bridge. Both peers dial out to it. No inbound rule needed. |
443 | HTTPS | Outbound | The relay, used for pairing. |
Source: pkg/config/constants.go, pkg/discovery/discovery.go.
| Endpoint | Default | Role |
|---|---|---|
| Relay | https://keibidroprelay.keibisoft.com/ | Exchanges encrypted registration blobs during pairing. It cannot read them. See the security model. |
| Bridge | bridge.keibisoft.com:26600 | Forwards encrypted bytes when a direct connection is impossible. Both peers connect out to it. |
Both are configurable: relay and bridge_addr in the configuration reference. strict_mode = true disables the bridge fallback.
| Value | Meaning |
|---|---|
| 15 s | The direct-connection accept window. If no direct path forms in this time, the connection falls back to the bridge. The result is remembered, so later connects on the same network skip the wait. |
| 30 s | Presence heartbeat interval. With a persistent identity and saved contacts, the app publishes a per-contact presence token so contacts see you online. Incognito mode, or having no contacts, disables it. |
| ~17 s | Typical first connect on a network that blocks direct connections (measured). Later connects skip the direct attempt. |
| Limit | Value |
|---|---|
| Peers per session | Exactly two. See Limits and known issues. |
| Free relay tier | About 3 connection attempts per 5 minutes. On limit, wait 5 minutes. Do not retry in a loop. |
| Direct P2P requirement | IPv6 on both ends. Test at test-ipv6.com; you need a score of at least 9/10. Without IPv6 the connection uses the bridge. |
KeibiDrop needs no inbound firewall rule to work: if inbound is blocked, both peers dial out to the bridge.
If you want direct connections through a firewall you control, allow inbound TCP on your inbound port (default 26431). For a corporate allow-list, permit outbound TCP to ports 26000-27000 and 26600, and HTTPS to the relay.
Practical steps are in How to work through firewalls and guest WiFi.