For NATs like UCLA Guest, or Caltech's network, which block UDP altogether, TCP ICE candidates are required to establish connectivity.