Subject: Re: (NAT) NAT frag

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 11 Dec 2000 17:32:34 -0800 (PST)

--- revati mariappan <[email-masked]> wrote:
> hi,
> 
> is there any way to support fragmentation with NAPT
> 
> manju

Here is what the Traditional-NAT draft says about fragmentation 
with NAPT.

6.3. Translation of outbound TCP/UDP fragmented packets in NAPT setup

   Translation of outbound TCP/UDP fragments (i.e., those originating
   from private hosts) in NAPT setup are doomed to fail. The reason is 
   as follows. Only the first fragment contains the TCP/UDP header that 
   would be necessary to associate the packet to a session for 
   translation purposes. Subsequent fragments do not contain TCP/UDP 
   port information, but simply carry the same fragmentation identifier 
   specified in the first fragment. Say, two private hosts originated
   fragmented TCP/UDP packets to the same destination host.  And, they
   happened to use the same fragmentation identifier. When the
   target host receives the two unrelated datagrams, carrying same 
   fragmentation id, and from the same assigned host address, it 
   is unable to determine which of the two sessions the datagrams 
   belong to. Consequently, both sessions will be corrupted.

cheers,
suresh

__________________________________________________
Do You Yahoo!?
Yahoo! Shopping - Thousands of Stores. Millions of Products.
http://shopping.yahoo.com/
-
To unsubscribe, email [email-masked]' with
'unsubscribe nat' in the body of the message.

---

From: Mike Handler <[email-masked]>
Date: Tue, 12 Dec 2000 09:27:48 -0500

A NAT implementer can implement around it, though, by defragmenting 
before NATting, or by translating fragmentation identifiers as well.

MH

-