Subject: (ngtrans) RE: Shipworm-05 comments #2 NATs and shortcuts

From: "Christian Huitema" <[email-masked]>
Date: Mon, 25 Mar 2002 09:01:51 -0800

This is the second response to Pekka's comments, addressing his concerns
about the different types of NAT:

>  - I think we also need a section on what happens if the assumptions
> about NAT's don't hold about Teredo-Teredo shortcuts (like 4.1.4)
> 
>  - Has the behaviour described in 4.1.4 been tested in practise?  I'm
> mostly curious about the more restrictive (port restrict, symmetric)
> cases.  I'm having hard time visualizing how the bubbles' ports are
being
> mapped in different NAT's.
>
> ...
> 
>  - I'm very worried about different NAT types.. I'd really like to get
> more concrete data on the behaviour.

The basic answers are: yes, we have tested the behavior described in
4.1.4, and it works in practice in very many cases. When the NAT don't
quite behave in the expected way, the behavior falls back to simply
relaying all the packets through the servers.

-- Christian Huitema

---

From: Pekka Savola <[email-masked]>
Date: Wed, 27 Mar 2002 15:31:23 +0200 (EET)

By the way, I did some digging in source code and made a few queries on 
NAT types I use:

 - Linux NAT implementations always use type 4)
 - *BSD ipfilter's ipnat does mostly 3) but also 4) under specific 
configurations

My assumption is that NAT boxes whcih do something like 1) or 2) are
probably the cheapo ones.  Also ones that are the most insecure.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords