Subject: Re: (NAT) NAPT behavior

From: Pyda Srisuresh <[email-masked]>
Date: Thu, 16 Sep 1999 08:59:01 -0700 (PDT)

--- Tim Dorcey <[email-masked]> wrote:
> Suppose a process behind a NATP writes a UDP packet from (private addr,port
> x) to some (addr,port) on the public Internet.  The NAT picks an arbitrary
> port y, and forwards the packet from (public addr,port y).  The process
> then immediately writes another packet from the same (private addr,port x)
> to a different destination (addr,port).  Assuming the NAT had not yet timed
> out the original port mapping, would it be safe to assume that a well
> behaved NAT would forward the second packet from the same (public addr,port
> y)?  If not, can anyone give a good reason why a NAT should not behave that
> way?
> 
You might want to take a look at Section 3.1, titled "Address Binding"
in the "Traditional-NAT" draft <draft-ietf-nat-traditional-01.txt>.
I believe, it addresses your question. To quote:

   While not a common practice, it is possible to have an 
   application on private host establish multiple simultaneous 
   sessions originating from the same tuple of (private address, 
   private TU port). In such a case, a single binding for the tuple 
   of (private address, private TU port) may be used for translation 
   of packets pertaining to all sessions originating from the same 
   tuple on a host.

(NOTE: The traditional-NAT draft has expired from the IETF drafts
       directory. I will be sending a repost of the draft shortly)  
    
> In a similar vein, if a NAT administrator has set up a static port mapping
> so that all UDP packets which arrive at (public addr,port y) are forwarded
> to (private addr,port x), is it safe to assume that any UDP packet which
> originates at (private addr,port x) will be forwarded from (public
> addr,port y)?
> 
Yes, if the NAPT believes the outbound packets to be pertaining to an
inbound session for which it already has a state. 

> Would either of the above depend on whether port x was in the registered or
> re-useable port range?

No.
> 
> I am trying to upgrade an application protocol to work with NATP, and
> haven't found much documentation on how these things work.  Thanks in
> advance for any info.
> 
> Tim
> 
> 
> -
> To unsubscribe, email [email-masked]' with
> 'unsubscribe nat' in the body of the message.
> 

cheers,
suresh
===

__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Tim Dorcey <[email-masked]>
Date: Thu, 16 Sep 1999 14:34:08 -0700

> inbound session for which it already has a state.

How about if there is currently no "inbound session?"  Does anyone know what a
typical NAPT would be expected to do?  Or, what any specific NAPT product would
do?

Tim

-