Subject: Re: [BEHAVE] RE: ICE performance

From: Saikat Guha <[email-masked]>
Date: Mon, 3 Sep 2007 11:37:55 -0400

Sorry for the late response (didn't see this before; thanks Philip for
the reminder)

On Thu, 2007-07-19 at 09:05 -0400, Philip Matthews wrote:
> http://www.guha.cc/saikat/pub/imc05-tcpnat.pdf
> 
> However, I think his setup was more of
> a test setup rather than a production setup.
> 
> Perhaps Saikat can tell us more.

We found port prediction worked pretty well in home networks where the
flows/sec through the NAT is a low number. 

Even then, in one case, a virus/worm on the internal host was SYN
flooding making it impossible to predicts ports accurately. Same is the
case for P2P applications that establish new connections rapidly.
(Although, if there is only one P2P app and it keeps track of the SYNs
it sends out, it can do port pred.)

As for enterprise networks, as Cullen mentioned, 1k f/s would make port
prediction impossible.

-- 
Saikat
_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: "Dan Wing" <[email-masked]>
Date: Tue, 4 Sep 2007 15:20:57 -0700

> I will just note that Saikat implemented port prediction in his TCP  
> study and found it worked pretty well.

On a quiescent network, with no or few other clients creating new bindings, it
can work alright.  However, a client has no way of knowing if it's on a
quiescent network or behind a massive ISP NAT with thousands of other UDP/TCP
clients creating new connections.  From the paper you cite:

  "In one particular case, the client host behind a
   NB:Connection NAT was infected with a virus that generated
   several randomly-addressed SYN packets per second
   causing all predictions to fail!"

-d

> - Philip