Slyber SFU Server - WebRTC Media Router for Calls, Webinars, and AI Bots A developer built Slyber SFU Server, an open-source WebRTC Selective Forwarding Unit written in Go on Pion WebRTC v4, distributed as a single static binary with no external dependencies. The server multiplexes all media over one port (4443) using ICEUDPMux and ICETCPMux, and adds Simulcast and VP9 SVC layer routing, WHIP/WHEP broadcasting, SFrame end-to-end encryption, HMAC inter-node cascading, and a full-duplex /ai/ws WebSocket gateway for connecting AI voice agents such as Gemini Live or the OpenAI Realtime API without a separate WebRTC stack. It also includes a FastSwapRouletteTrack path for 1v1 roulette-style switching that rewrites sequence numbers and timestamps to avoid SDP renegotiation and black-screen gaps. Hey devs 👋 In this overview, I will explain in simple terms what Slyber SFU Server is, why it is needed, how it works under the hood, and what problems it solves out of the box. High performance WebRTC Selective Forwarding Unit SFU built with Go and Pion WebRTC v4, featuring a single port ICE-Lite UDP/TCP multiplexer, Simulcast & VP9 SVC routing, WHIP/WHEP broadcasting, SFrame End to End Encryption E2EE , inter-node HMAC cascading, and a full duplex AI voice WebSocket pipe. sync.Pool packet buffers SlyberPacket , atomic reference counting, in place RFC 3550/8285 header parsing, and copy on write subscriber snapshots. ICEUDPMux , RFC 4571 ICE-TCP ICETCPMux , DTLS-SRTP encryption, TWCC sender feedback, and NACK generation on a single media port 4443 by default . ClampSpatialLayer , per layer NACK… Slyber SFU Server is a real time selective audio, video, and data routing server written in Go. It is distributed as a single static binary with zero external dependencies and handles group video conferences, 1 on 1 calls, live streaming for example, from OBS Studio , and voice conversations with AI agents. It can also be deployed via Docker. When two people make a direct call in a browser, their devices exchange video and audio without intermediaries. However, as soon as 10 people join a room, peer to peer connections break down: each participant's browser is forced to compress and upload 9 separate copies of their video and audio one for every other participant. Phones quickly overheat, and batteries drain rapidly. An SFU Selective Forwarding Unit acts like an automated mail sorting center: I designed the server so that it can be deployed on a clean Linux machine in one minute without manually editing configuration files. Here is what the system consists of: :4443 for Both UDP and TCP In Slyber SFU Server, all media traffic across all rooms flows through a single port 4443 . At the ingress, it uses ICEUDPMux and ICETCPMux multiplexers RFC 4571 standard : 8090/TCP port handles WebSocket signaling /ws , broadcast gateways, and telemetry metrics. q , h , f layers for example, 270p, 540p, and 1080p and the scalable SubscriberBWE bandwidth controller continuously monitors reports from each viewer TWCC , REMB , RTCP Receiver Report . As soon as a specific viewer's bandwidth drops or packet loss increases, the server smoothly switches In a 30 person group call, there is no point in transmitting video from all 28 silent participants. The server reads the audio volume level from the unencrypted RFC 6464 ssrc-audio-level packet header without decrypting the voice payload itself. The EnforceLastNVideo mechanism automatically pauses cameras of silent participants and instantly resumes their video starting with a keyframe as soon as they begin speaking. In standard WebRTC, switching conversation partners requires re-exchanging SDP Offer/Answer messages, which leaves the viewer staring at a black screen for 1–2 seconds. For the roulette 1v1 profile, Slyber SFU implements the FastSwapRouletteTrack method. Candidate streams are pre-warmed at ingress, and switching happens simply by flipping an internal pointer. The SeqTimestampRewriter module aligns packet sequence numbers SequenceNumber and timestamps of the new partner on the fly so the viewer's browser perceives the stream as continuous with zero gaps and zero SDP renegotiation. /ai/ws Gateway for AI Voice Agents To add a voice bot powered by Gemini Live or the OpenAI Realtime API to a call, you do not need to run a heavy WebRTC stack in Python or Node.js. Simply connect your AI backend to the built-in /ai/ws WebSocket gateway: mode=mux : ai vad barge in event to your backend. WHIP/WHEP , MoQ , and Server Cascading POST /whip/{room}/{track} and distribute to viewers via POST /whep/{room}/{track} in a single HTTP request with ETag -based stream owner protection. moqt-draft-22 objects /moq/{room}/{track} . /cascade/ : HMAC-SHA256-128 cryptographic signature on every packet and built-in SSRF protection against attacks on local subnets. HS256 JWT tokens with granular permissions like can publish , can subscribe , max spatial layer , a pooled Redis connection instant access revocation upon deleting the slyber:session: