Subject: RE: (ngtrans) I-D ACTION:draft-ietf-ngtrans-shipworm-07.txt

From: "Christian Huitema" <[email-masked]>
Date: Fri, 13 Sep 2002 17:18:56 -0700

> I don't know if there are any deployed NATs with this
> behavior, but I designed the NAT functionality for a CMTS to
> accept all hosts from the same subnet a known host.

When it comes to this type of boxes, there seem to be no limit to
invention... By the way, how did you define "same subnet" ? Using the
old class A, class B, class C? a /24? 

> Unless there is a strong concensus that such clever tricks
> have not survived as NAT functionality evolved I would
> suggest that the test specified in 4.1.3 be modified. In
> addition to specifying that:
> 
> >and it will send RA advertising a prefix including the
> >null address (e.g. PREF::/L) from a different IPv4 address.
> 
> it might make sense to add "The different IPv4 address
> SHOULD be from a different subnet."

That looks reasonable. But that may be harder to deploy, since a "legit"
implementation will require multi-homing to 2 different subnets. Indeed,
one could make a clever use of raw sockets and spoofed source addresses,
but I am not sure I want to encourage that...

-- Christian Huitema

---

From: Caitlin Bestler <[email-masked]>
Date: Fri, 13 Sep 2002 20:28:40 -0500

On 9/13/02, Christian Huitema wrote:

>When it comes to this type of boxes, there seem to be no
>limit to invention... By the way, how did you define "same
>subnet" ? Using the old class A, class B, class C? a /24? 
>
The 'standard' definitions. After all, the point was to
reduce the unwanted inbound traffic, while reducing as much
as possible the risk of blocking legitimate traffic.

>That looks reasonable. But that may be harder to deploy,
>since a "legit" implementation will require multi-homing
>to 2 different subnets. Indeed, one could make a clever
>use of raw sockets and spoofed source addresses, but I am
>not sure I want to encourage that...

Good point. It might make sense to just make it a suggestion
to use a different subnet if one is easily available.

Caitlin Bestler
http://asomi.com/CaitlinBestler/