Saikat Guha, Paul Francis: Characterization and Measurement of TCP Traversal through NATs and Firewalls. In: Proceedings of the 5th ACM SIGCOMM Conference on Internet Measurement. 2005 (cornell.edu [PDF]).
wander.science
Sebastian Holzapfel et al.: SYNI – TCP Hole Punching Based on SYN Injection. In: IEEE 10th International Symposium on Network Computing and Applications. 2011 (wander.science [PDF]).