Subject: RE: (ngtrans) Teredo comment, vile rewriting NATs

From: "Christian Huitema" <[email-masked]>
Date: Thu, 26 Sep 2002 11:21:56 -0700

>  >>P.S. See also my previous comment regarding "obfuscated" address
> format.
>  >
>  >
>  > Yes, I saw it. But you must realize that the first goal of Teredo
is,
> to work
>  > with the existing NAT, those that are already deployed. I don't
want to
>  > tie Teredo's success to modifying the existing NAT; if we could do
> that,
>  > we could just as well ask them to support 6to4.
> 
> You may have seen my previous message, but you didn't respond to my
> assertion
> that a NAT that blindly replaces any values that match an IP address
or
> port
> number in the protocol data is fundamentally broken and should be
> dismantled.
> Do you agree or disagree with this assertion?

I certainly agree that these NATs are broken. However, I don't believe
that we can realistically hope to have them discarded and replaced
overnight. It is better to have a simple mitigation, obfuscate the
address, than to have to answer customer calls.

-- Christian Huitema