Subject: Re: NATs *ARE* evil!

From: "Tony Dal Santo" <[email-masked]>
Date: Thu, 14 Dec 2000 14:54:29 -0500

Dennis Glatting wrote:

> On Thu, 14 Dec 2000, Sean Doran wrote:
>
> > So, why are people deploying them?
>
> Just to name two...
>
> 1) With NAT I ask for much smaller address spaces. Consequently, I don't
> have to disclose my network details, deployment is less likely to be
> delayed, and both my non-recurring and recurring cost is lower.
>
> 2) I don't have to renumber my entire enterprise should I change service
> providers, rather only the Internet interface devices.

What exactly is the state of the IPv4 "address pool"?  I realize there is
a PERCEIVED shortage, and this is usually the main motivation for NAT.
But is there a real shortage?  Are "reasonable" requests for addresses
being denied?

As for the renumbering hassle, if you have a small installation,
renumbering shouldn't be all that difficult (especially when using
DHCP).  For large installations, doesn't the organization own the
address pool, and take it with them when they change ISPs?  I know
this used to be the case.

If it isn't an address issue, is it a routing issue?  Is it that the
routing tables/protocols/hardware can't handle the large number of routes?
Are ISPs refusing to carry reasonable routes?  Seems to me if the entire
address space was broken up into subnets of 4096, there would be about 1
million routes.  What is the current size?  I think I remember seeing
numbers on the order of 50,000.

If there is a real shortage or routing problem, I understand the motivation
to use NAT.  There really wouldn't be a reasonable alternative.  But I have
yet to hear anyone claim that a reasonable request has been denied.  Based
on that, I tend to think most NAT installations are motiviated by other
(and in my opinion less valid) issues such as "security".

Tony Dal Santo

---

From: Dennis Glatting <[email-masked]>
Date: Thu, 14 Dec 2000 14:11:00 -0800 (PST)

> this used to be the case.

Ever renumbered and enterprise? DHCP is the cheap and easy part, and
sometimes not so. Reconfiguring fielded lap tops is much harder (such as
domain entries and VPN), as is making any configuration changes to
servers, such as 24x7 ERP systems.

The last time I renumbered an enterprise it was an enterprise of about
1000 nodes spread across seven states. It took a quarter to get the cheap
and easy stuff done, which included travel to the smaller sites who had no
IT staff. It took another quarter to get the harder stuff (active servers,
take out hacks, etc.). And it took another quarter to clean up all of the
stragglers (people who hard coded /etc/hosts, started old applications,
turn on old machines, etc.).

You can't get address pool space from ARIN for anything less than a /20,
last I looked.

> routing tables/protocols/hardware can't handle the large number of
> routes? Are ISPs refusing to carry reasonable routes?  Seems to me if
> the entire address space was broken up into subnets of 4096, there
> would be about 1 million routes.  What is the current size?  I think I
> remember seeing numbers on the order of 50,000.
> 

Current size as of a few months ago was 85k routes.

> If there is a real shortage or routing problem, I understand the
> motivation to use NAT.  There really wouldn't be a reasonable
> alternative.  But I have yet to hear anyone claim that a reasonable
> request has been denied.  Based on that, I tend to think most NAT
> installations are motiviated by other (and in my opinion less valid)
> issues such as "security".
> 
> Tony Dal Santo
> 
>

---

From: Geoff Huston <[email-masked]>
Date: Fri, 15 Dec 2000 09:33:24 +1100

>Current size as of a few months ago was 85k routes.

correct. Now its pushing around 100,000, That's a relatively steep
growth curve. (www.telstra.net/ops/bgp)

The rate of growth in the table and the prefix length distribution
in the table both point to the growth of small prefixes (/24)
as a major factor in the growth of the routing table.

There are strong indications that NAT is one factor behind this
part of the BGP table.

Now I'm not saying that this is either good or bad - what is evident
is that much of the recent growth in the deployed Internet has happened
behind NATs of various forms and the side effect is low levels of overall
address space growth as reflected in the span of address space advertised
in the BGP tables, but an increasing finer level of granularity in the
routing table. There are of course other factors also at play which 
are causing the same outcomes, so NAT is not the only driver.

So its not NATS *are* evil - NATs are very commonly used these
days and we simply cannot deny their existence nor condemn their
use as unworkable. NATs are a *compromise* - some folk find the compromise
unacceptable - others do not. These days out there in the network as
my bgp table sees it, a large number of folk find NATs a comfortable
compromise. 

I won't speculate whether these folk are making a fully informed decision
or not - the BGP table has no such data embedded in it that can
be reliably interpreted.

regards,

   Geoff

---

From: James Aldridge <[email-masked]>
Date: Thu, 14 Dec 2000 23:40:47 +0100

> Current size as of a few months ago was 85k routes.

Today's global BGP table (at least from one view) contains approx. 95,000
entries (and it went over 100,000 for a short time yesterday).  Take a look
at http://www.mcvax.org/~jhma/routing/ for three years' history and a daily
generated list of aggregation possibilities which could take the routing table
down to a mere 65,000 or so entries.

James

---

From: Frank Solensky <[email-masked]>
Date: Thu, 14 Dec 2000 19:54:50 -0500

Tony Dal Santo wrote:
> 
> What exactly is the state of the IPv4 "address pool"?

Hilarie Orman, Scott Marcus and I will be working together over the next
few weeks to get a more up-to-date view of the world.  As soon as we get
something together, we'll announce it to the list.
						-- Frank

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 14 Dec 2000 18:56:45 -0600

Frank,

This is goodness. Can I ask that you publish the *method* before
you publish any results? I have seen various attempts to
tackle this in the past, and they have all given results that
are very hard to interpret and whose meaning depends very much
on the method used. I think we could react to the numbers more
rationally if we discussed the method first.

Thanks anyway

   Brian

---

From: Frank Solensky <[email-masked]>
Date: Thu, 14 Dec 2000 20:12:57 -0500

> rationally if we discussed the method first.

Sure thing.

Would it make sense to spin this off as a separate list?

---

From: "David W. Morris" <[email-masked]>
Date: Thu, 14 Dec 2000 20:05:18 -0500 (EST)

> There are strong indications that NAT is one factor behind this

I believe that would be missinterpretation of the data. Operationally,
there is strong pressure on ISPs to allocate few addresses to individual
customers and I suspect that this philosophy moves upward in the address
space allocation philosophy. Because the allocations occur in smaller
chunks (to manage supply), there is less opportunity to aggregate larger
blocks of addresses leading to the observation re small prefixes. NAT
reduces the number of discrete IPs needed for an Internet connected site.
It allows the restricted allocation philosophy, it doesn't cause it.

Dave Morris

---

From: Keith Moore <[email-masked]>
Date: Thu, 14 Dec 2000 22:21:04 -0500

> NAT reduces the number of discrete IPs needed for an Internet connected site.

NAT allows us to put a larger number of hosts behind a smaller prefix
than would otherwise have been possible.  It doesn't directly cause
the growth in the routing table size, because those routing table
entries would have been equally necessary if those hosts currently
behind NAT were using global address space. 

In a sense, NAT may have been responsible for a false sense of 
security regarding routing table growth - because much of the growth 
in the network was within NATted networks, it wasn't immediately 
necessarily for those networks to allocate large amounts of global 
address space.  But as those NATted networks grew to support more 
users, some of those networks' operational requirements would have 
naturally increased to the point that they needed more reliable external 
connectivity through multhoming, which in turn would require additional
entries in routing tables.

Thus, while NATs may help conserve the global addess pool, they do not 
necessarily conserve routing table space to the same degree.

But even as a dedicated NAT-hater I cannot find much fault with NAT for
this reason.  (I blame NATs for other things, but not for this)

Keith

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 15 Dec 2000 09:33:53 -0600

> Would it make sense to spin this off as a separate list?

big-internet is probably still there.

  Brian

---

From: Fred Baker <[email-masked]>
Date: Thu, 21 Dec 2000 16:41:45 -0800

>But is there a real shortage?  Are "reasonable" requests for addresses

The way I understand it (which could easily be out of date) is that about 
45% of the address pool has been delegated, and about 25.21% is currently 
being advertised. The unicast address pool, what we once called the class 
A, class B, and class C address pools, represents 7/8 of the IP Addresses: 
the remainder are divided among the multicast (class D) and experimental 
(class E) address space.

So the bottom line is that we have delegated out a touch over half the 
usable unicast IP Address space. The way we are using that is, in many 
places, interconnecting NAT translation points - the use of private address 
space hides the real usage, and we have no really good way to estimate it. 
If we start going for non-client-server protocols - voice on IP - in a big 
way (and I am told that some of the world's largest telephone carriers have 
plans in place to convert national and international telco backbones to 
VoIP over the coming 3-5 years), that means that these devices will need to 
be addressable from outside their domains, which means those people will 
find themselves needing a non-NAT'd address. Implications are largely 
speculative, but have the option of being non-pretty.

Next question, not usually discussed, is how much of the world as yet 
doesn't have IP Addresses allocated to it and would like to. I think it is 
fair to say that the world is convinced that IP connectivity is very 
important. I have heard ministers of telecom from dirt-poor African 
countries discuss how wonderful it would be to have so much free capital 
laying around that they could "put a telephone into each village." Those 
same ministers are doing whatever it takes to ensure that their countries 
are on the Internet.

Unfortunately, the world is not internet-attached. Western Europe is, the 
US and Canada are, Australia is, Taiwan has Internet in every public 
library (I'm told). It comprises populations in the 1 billion person 
ballpark. There are some pretty large swaths of people in Eastern Europe, 
Asia, and Africa that are not connected and should be. If 25% of the 
address space is what we need for the part connected now, that tells me 
that I need 150% of the address space to cover everybody. If wide 
deployment of converged networks means that 25% was nowhere close enough 
for the present Internet population, then 150% is a very low guess.

So that's "what is" last I heard it from those who have the hard numbers, 
and "what could be". "What will be" remains anybody's guess. My crystal 
ball is really shiny due to excessive rubbing, and just as cloudy as ever.

---

From: Fred Baker <[email-masked]>
Date: Thu, 21 Dec 2000 17:09:00 -0800

At 04:41 PM 12/21/00 -0800, Fred Baker wrote:
>Asia, and Africa that are not connected and should be.

before I get flamed, let me hasten in with - I left out a lot of countries 
that have some level of internet attachment. My point is not that "your 
favorite country has no attachment", but that "there are relatively few 
countries that have essentially pervasive attachment". If you still think 
I'm missing your favorite country, flame me privately :^)