Subject: Again: Number of Firewall/NAT Users

From: Jiri Kuthan <[email-masked]>
Date: Tue, 23 Jan 2001 17:00:36 +0100

Hello,

as the discussion departed from my original question to
the favorite discussion on NAT/ipv6/etc architectural issues,
I would like to re-raise the question:

"is anyone aware of any estimations of fraction of Internet users
who are behind firewalls and NATs?"

Thanks,

Jiri

---

From: Frank Solensky <[email-masked]>
Date: Tue, 23 Jan 2001 12:10:44 -0500

> who are behind firewalls and NATs?"

Before it goes off into DNS name administration:

None that I've heard of.  From the perspective of those inside the NAT
firewall, the fact that outside world can't tell the size of the hidden
network is an advantage.

One could ask a sample of administrators and extrapolate the results
but, again, the problem becomes how confident you could be of the
results if you don't get a very significant response rate  (I tried
something like this a number of years ago when attempting to estimate
the proportion of assigned IPv4 addresses were actually being used:
expect a healthy degree of skepticism if the queries are coming out of
the blue).

Even if that were possible or in a world without NATs, though: are you
assuming a 1:1 mapping between IP addresses and 'users'?  Between
mainframes in one direction and folks surrounded by multiple machines in
the other, which way do you go?  Is there a 'user' associated with a web
server; if so, what if you've got a load balancer in front?

						-- Frank

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Tue, 23 Jan 2001 10:38:57 -0800

At 12:10 PM -0500 1/23/01, Frank Solensky wrote:
>results if you don't get a very significant response rate

The problem is *much* worse than that. You have to be confident that 
your sampling method actually reflects enough of the Internet to be 
valid. Determining how you have reached a valid sample of 
administrators would be an interesting problem. Further, it is safe 
to assume that administrators for the largest networks are the least 
likely to reply, or to reply accurately.

And then there is the problem of assuming that they understand your 
question, and can even count the systems on their networks well 
enough to answer accurately...

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Brian E Carpenter <[email-masked]>
Date: Tue, 23 Jan 2001 14:10:17 -0600

Exactly. More or less by definition, since NATs and firewalls hide
stuff, we can't possibly measure the stuff they hide.
And since they are hiding stuff for good reason, administrators
more or less by definition will not answer accurately. So it can't
be measured.

My hand waving estimate is that 40% (160M) of users are behind a firewall
and/or NAT, 50% (200M) on dial-up, and 10% (40M) have direct always-on access.
But there is no way I can justify these numbers.

  Brian