Subject: RES: ReN: (ngtrans) IPv6 tranisition issues

From: "Marcelo Barbosa Lima" <[email-masked]>
Date: Mon, 6 Jan 2003 08:56:20 -0200

I think that NAT is a good workaround and it can be done to support all aplications (the cost is more complex code -- Code more complex = more bugs = more security problems = poor performance = ...). NAT is implemented in routers and firewalls. So, it put more dificulty to implementators, provides problems to performance, etc. NAT and VPNs solutions normally don´t work very well together. I think that NAT is something that several vendors would like to kill :-). Routing and firewalling could do only your work, without regarding address translation. In IPv6, routing is more easy and NAT is not necessary anymore. So, packets can flow faster in Internet. 
REgards,

			Marcelo.

-----Mensagem original-----
De: Michael R. Cole [mailto:[email-masked]]
Enviada em: terça-feira, 31 de dezembro de 2002 09:20
Para: [email-masked]
Assunto: Re: ReN: (ngtrans) IPv6 tranisition issues 

----- Original Message -----
From: "Keith Moore" <[email-masked]>
To: "Michael R. Cole" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, December 31, 2002 12:28 AM
Subject: Re: ReN: (ngtrans) IPv6 tranisition issues

> >  A NAT box is just simply
> > a retooled router,
>
> that's a truly bizarre statement.  I suppose it's true from a
> hardware perspective, but it's like saying that a NAT box is
> just a retooled computer with a couple of network interfaces -
> true, but irrelevant to the question at hand.
>
> > just that some are better and some are worse.
>
> all NATs break applications.  some NATs know about a few more
> protocols than others, but no NAT can handle every possible protocol,
> many protocols simply cannot be made to work transparently through NAT.
>
> Keith
>

Your definition of the word break must be different than the one in the
dictionary. If an application works with a NAT box, then it is NOT BROKEN!
Your claim would also say that a timesharing system with only 1 public IPv4
address would not work which is what a cone NAT mimics. That is, a cone NAT
fools that public Internet into thinking that a LAN or other subnet is in
actuality a single machine. At any rate, a NAT box is a patch that gets
around the problem that a good sized chunk of the IPv4 address space was
wastefully allocated to the original players at essentially zero cost.

Maybe your first experience with a NAT box was with a really crummy one? If
that is your only experience or of you have no experience with NAT boxes,
then you have no business crticizing them. Some NAT software that I have
tried was absolutely horrible.

I am not trying to say that the better NAT boxes will work with ALL
applications. Somehow, the cable companies are able to use them at their
headends without breaking applications. However, I have noticed that
enterprise-class NAT boxes use a server-client setup so that applications
are not really aware or can tell that they are indirectly connected to the
Internet. Symmetric NAT boxes probably do work better in part because they
mimic a timesharing system with one public IPv4 address for each user.

Of course, some applications are very picky about what they will eat.

MIke Cole, [email-masked]

---

From: Keith Moore <[email-masked]>
Date: Mon, 6 Jan 2003 12:51:24 -0500

On Mon, 6 Jan 2003 08:56:20 -0200
"Marcelo Barbosa Lima" <[email-masked]> wrote:

> 
>   I think that NAT is a good workaround and it can be done to support all aplications

you are mistaken.  your statement is completely and utterly incorrect.

Keith

---

From: "Jeroen Massar" <[email-masked]>
Date: Mon, 6 Jan 2003 19:05:54 +0100

> you are mistaken.  your statement is completely and utterly incorrect.

/me sings Netmeeting (H323 or something) and many more ;)

And then still one can't setup a box behind a nat to do FTP and then
have the outside world contact it unless the admin of the NAT box
is doing per connection redirection. Which is simply not done.

NAT != P2P -> and thus not the idea why people invented the internet.

Greets,
 Jeroen

---

From: "Fred L. Templin" <[email-masked]>
Date: Mon, 06 Jan 2003 11:03:43 -0800

Keith,

No offense intended, but I am beginning to suspect that you have
somehow implemented an "automatic insult generator" in your mailer
that is triggered anytime someone mentions the word "NAT". :^}

Fred Templin
[email-masked]

---

From: Keith Moore <[email-masked]>
Date: Mon, 6 Jan 2003 14:11:03 -0500

On Mon, 06 Jan 2003 11:03:43 -0800

> that is triggered anytime someone mentions the word "NAT". :^}

it's difficult to not respond when people make irresponsible comments about NAT.

---

From: "Michael R. Cole" <[email-masked]>
Date: Wed, 8 Jan 2003 02:00:18 -0500

----- Original Message -----
From: "Fred L. Templin" <[email-masked]>
To: "Keith Moore" <[email-masked]>
Cc: "Marcelo Barbosa Lima" <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Monday, January 06, 2003 2:03 PM
Subject: Re: RES: ReN: (ngtrans) IPv6 tranisition issues

> > you are mistaken.  your statement is completely and utterly incorrect.

Keith Moore SHOULD have written:

NAT breaks Unix applications but not Windows applications.

My opinion: the original purpose of TCP port numbers and UDP port numbers
was to allow more than one process or user to share the same connection or
other resource. For instance, when two or more people access a web site each
one gets a one or more port numbers to go with the site's address. This way,
the web site only needs to have ONE address.

LIkewise, NAT essentially does the same thing on the other end by allowing a
LAN or other subnet to pretend to be a single timesharing machine with only
ONE IPv4 address. This is much like how if I open a 2nd instance of Internet
Explorer on my browser (which currently does not have NAT software) it uses
port 81 instead of port 80. That is, the 2nd instance figures that somebody
else grabbed port 80 first so it just goes and finds another open port. NAT
is just simply an extension of existing concepts that were first applied to
mainframes that were connected to Arpanet.

I have played around with enough firewalls and NAT packages to know that
software quality varies all over the place. As for the claim that NAT breaks
applications there is sometimes a problem with pushing the right buttons to
get it to work. Norton Antivirus 2002 for instance will crash some web pages
because I have script blocking enabled - it is not really possible to tell
if a script is friendly or malicious. Likewise, Popup Stopper has an
override feature to allow friendly popups.

Mike Cole, [email-masked]

---

From: Rod Van Meter <[email-masked]>
Date: 08 Jan 2003 14:41:15 -0800

> Enviada em: terga-feira, 31 de dezembro de 2002 09:20
> actuality a single machine.

That's a gross oversimplification that eliminates the actual problem, so
of course it doesn't sound bad when you put it that way.

When a computer has a global address, you open a socket and get a port,
and you can tell anyone anywhere in the world using any communications
medium that they can reach you there.  You can call someone on the
telephone and tell them, "My cool new game server is at port 1982 on
1.2.3.4!" and it works.  You can send the info via snail mail, and it
works.  One friend can tell another friend, and it works.

With NAT, you can't do that, end of story.  The NAT box HIDES
INFORMATION from BOTH ENDS of the conversation, so you can't know what
the people at the other end see your address and port number to be.

It also does not allow YOU to hide information for protocols it expects
to affect.  You can't do FTP over IPSec, because then the NAT box can't
reach into the FTP packets and modify them.

I would have thought that all of this was pretty well understood by
now...

		--Rod

---

From: "Michael R. Cole" <[email-masked]>
Date: Fri, 10 Jan 2003 04:28:55 -0500

----- Original Message -----
From: "Rod Van Meter" <[email-masked]>
To: "Marcelo Barbosa Lima" <[email-masked]>
Cc: "Michael R. Cole" <[email-masked]>; <[email-masked]>
Sent: Wednesday, January 08, 2003 5:41 PM
Subject: Re: RES: ReN: (ngtrans) IPv6 tranisition issues

> I would have thought that all of this was pretty well understood by

Well of course it was an oversimplification but then the NAT box software
that I did get to work on my home network (on a trial basis) seemed to be a
lot smarter than one other that I tried. There is also a commercial grade
NAT+firewall+gateway software package on the market that does have versions
of ping and traceroute that do allow you to find out what address+port
combinations the box is presenting to other people. It is also about twice
the cost (for the same number of users) of the cheapies that are sold for
residential use.

Right now, my budget levels are such that I am not doing that much playing
around with software packages to see how well they work. The only
application that I have for NAT right now is to run Atomic Clock Sync which
does not justify the expense. I would also rather wait for a better
connectivity package that would allow an IPv6 router to run in parallel with
the NAT functionality so that I do not end up buying software twice.

MIke Cole