Subject: Re: [MMUSIC] RE: Symmetric NAT traversal is a key feature. (was: draft-ietf-mmusic-rtsp-nat-00.txt)

From: [email-masked]
Date: Fri, 28 Feb 2003 12:52:38 +0100

Tom,

no more 3093'zation please! my wife is getting worried
she said I am speaking to myself at night and I keep on
saying "non! non! pas la trente quatrevingt treize!
pas la trente quatrevingt treize!"

;-)

>> "Symmetric NATs SHOULD be configured so that a given RTP
>> client is attributed the same public IP address as the corresponding
>> RTSP client"
>
>I have yet to see an example where a client was assigned different public IP
>addresses for RTSP and RTP connections to the same server.  Rumors keep
>flying that they exist so I'll assume they do.
>
>I like this recommendation -- it should always be the case anyway.  If it's
>not, the NAT is being unreasonable.
>
> (if there are NAT implementors online can they please comment on that?
> it does not look like a very difficult thing to implement ?)
>
>Yes, please.  Does someone run a NAT where a given (client_ip, server_ip)
>can be mapped to more than one nat_ip?

I think a lot of NATs are running on a single public IP address:
it gives 60000+ ports to multiplex clients through which is already
quite a bit...so we dont see it happen now.

My concern is to get in trouble for larger deployements where the
operator has many more public IP addresses because I suspect
the "most simple" way to implement such NAT is to pick up the first free pair
(public IP address, port number) and since de-allocation and allocation
are stochastical then there is a fair chance that RTSP and RTP can be mapped
on different public IP addresses..

>I am wondering if you are equating "symmetric NAT" with a NAT that maps
>clients to multiple public addresses.

I am equating "symmetric NAT" with a NAT that *may* maps
clients to multiple public addresses.

>
>My understanding is that symmetric NAT is a more strict case of general NAT.
>The difference is that a general NAT maps a given NAT port based on the pair
>(client_ip,client_port) and a symmetric NAT maps a given NAT port based on
>the 4-tuple (client_ip,client_port,server_ip,server_port).  Am I mistaken?

I dont know what you mean by "general NAT"?
my reference for NAT typologie is the STUN draft?

I think your 4-tuple is accurate for "symetric NAT"
unless it is a 5-tuple including the protocol
i.e. TCP vs UDP?

regards,

Philippe Gentric
Software Architect
Philips MP4Net
[email-masked]
http://www.platform4.philips.com

                                                                                                                                       
                                                   To:   Philippe Gentric/MP4-SUR/CE/PHILIPS@EMEA1                                     
                                                   cc:   [email-masked]                                             
                                                    [email-masked]                                                                    
                                                   Subject:    Re: [MMUSIC] RE: Symmetric NAT traversal is a key feature. (was:        
               Tom Marshall                         draft-ietf-mmusic-rtsp-nat-00.txt)                                                 
               <[email-masked]>                                                                                                    
                                                   Classification:                                                                     
               27/02/2003 18:26                                                                                                        

> >The sysadmin vs. netadmin argument holds no water.  We should NOT be
> >providing a means to deliberately break administrative control.  (It's
> >redundant anyway, see RFC 3093).
> >
> ....
> >But it is not our intent to deliberately undermine administrative
> >control.
>
> ha no! not that!
> you cannot 3093'ze me on this because
> 3093 does not apply a single bit here.
> (I feel in the position to debate about 3093 since the London meeting!-)
>
> the plan is not  to undermine "administrative control",
> because and *that* is the point: you *cannot* "undermine" it!
>  when the adminitrator wants to block RTP traffic  he will,
> because he can and it is *very* easy!!!!!!

Am I the only one here that reads the same argument for 3093?

  the plan is not  to undermine "administrative control",
  because and *that* is the point: you *cannot* "undermine" it!
   when the adminitrator wants to block 3093 traffic  he will,
  because he can and it is *very* easy!!!!!! it's a simple matter
  of blocking the "TCP_*", "IP_*", "IP4_*", and "IP6_*" headers!!!

> (A)in order of priority for operators "NAT comes first" and then
> "someone wants to fix the RTP problem" specifically we are told:
> "ok, there is this NAT, and we want to deploy
> VOD using RTSP, what do you propose ? "

> But we will have to influence "them" in at least one respect,
> it must be documented somewhere that:
>
> "Symmetric NATs SHOULD be configured so that a given RTP
> client is attributed the same public IP address as the corresponding
> RTSP client"

I have yet to see an example where a client was assigned different public IP
addresses for RTSP and RTP connections to the same server.  Rumors keep
flying that they exist so I'll assume they do.

I like this recommendation -- it should always be the case anyway.  If it's
not, the NAT is being unreasonable.

> (if there are NAT implementors online can they please comment on that?
> it does not look like a very difficult thing to implement ?)

Yes, please.  Does someone run a NAT where a given (client_ip, server_ip)
can be mapped to more than one nat_ip?

> Because otherwise whenever the symmetric NAT will allocate different IP addresses
> the RTSP server will *have to* deny the service for DDOS prevention.

I am wondering if you are equating "symmetric NAT" with a NAT that maps
clients to multiple public addresses.

My understanding is that symmetric NAT is a more strict case of general NAT.
The difference is that a general NAT maps a given NAT port based on the pair
(client_ip,client_port) and a symmetric NAT maps a given NAT port based on
the 4-tuple (client_ip,client_port,server_ip,server_port).  Am I mistaken?

> >NAT traversal is intended to work around the limitations in common NAT
> >implementations.
>
> not enough for me,
> I want a solution for all NATs, forever.

I want world peace, too.  And no more spam.  And ...

Seriously, there is no all-encompassing solution.  Why not?  Because NAT is
the general name for a family of hacks with no formal specification or
interoperability requirements.  As soon as you design a solution that you
think covers all NATs, someone will build a different NAT that breaks your
solution.

Symmetric RTP and multiplexed STUN/RTP are functionally equivalent for NAT
traversal and they are the best solution you will find in the forseeable
future.

--
Any sufficiently advanced technology is indistinguishable from a rigged
demo.
        -- Andy Finkel
(See attached file: attde3bo.dat)