SFU (Selective Forwarding Unit)

The three ways to run a group call differ in where the work happens. Peer-to-peer sends every participant’s stream to every other participant directly, which is simple and collapses past a handful of people. An MCU decodes all the streams, composites them into one and sends a single stream out, which is cheap for the client and extremely expensive for the server. An SFU sits between: it forwards without transcoding, so server cost stays modest while clients receive separate streams they can lay out as they like.

Forwarding rather than transcoding also enables the features people expect from a modern call. Because each stream stays separate, a client can request a lower-resolution version of a participant it is showing in a small tile — simulcast — and the server can drop layers when a network degrades instead of dropping the call.

The trade-off is that an SFU sees the media as it passes through, unless a separate layer of encryption is applied above the transport that the server does not hold the key to. That layer is what distinguishes a call the operator could observe from one it could not.