Subject: Re: [Ietf-behave] Next rev on TCP Behavior

From: Pyda Srisuresh <[email-masked]>
Date: Sun, 17 Apr 2005 08:59:59 -0700 (PDT)

Saikat,

This is a lot of work you and your team has done. Lot of interestig data. Thank
you for your work.

I believe, your results indicate that a overwheleming majority of the devices
use the following timeouts in various phases of the TCP session.

SYN-SENT:   >1min (73%)
ESTD:       >2hrs (53%), 15min-1hr (31 out of 100)
TIMED-WAIT: >1 min (65%)
RST:        >1 min  (58%)

However, I noticed that only a small portion of the devices tested (13%) use
port binding. Vast majority of the devices tested (85%) use independent
binding. By "independent binding", I assume, you meant address binding. If not,
please clarify. Thanks. As you now, many of the residentail NATs are NAPT
devices. I am a concerned if the results are representative of the NAPT devices
profile.

Please cinfirm if I am interpretng the results right. It seems the results are
generaly encouraging and fit the profile of the requirements outlined in the
behave-tcp draft (with the exception of timeout values).

Look forward to hearing your thoughts.

cheers,
suresh
 
--- Saikat Guha <saikat@xxxxxxxxxxxxxx> wrote:
> On Tue, 2005-04-12 at 14:29 -0700, Senthil Sivakumar wrote:
> > I believe there was a test conducted on the behavior of many NAT boxes, 
> > does any
> > one have the data of what the timeouts of different boxes were?
> 
> The STUNT tests include TCP timeout tests. The results are online at
> https://www.guha.cc/saikat/stunt-results.php
> 
> -- 
> Saikat
>

---

From: Saikat Guha <[email-masked]>
Date: Sun, 17 Apr 2005 12:07:34 -0700 (PDT)

> use the following timeouts in various phases of the TCP session.

The reports included hosts that ran the test without being behind a NAT
or were configured in the DMZ for the NAT (all unmatched packets were
sent to them). Those showed up as TCP Filtering Type: Open and may have
thrown off your numbers. I've changed the default tabulation to hide
those for now.

> ESTD:       >2hrs (53%), 15min-1hr (31 out of 100)

I get 
SYN-SENT: >1m 45/72 (62%)
ESTD: >2h 26/72 (36%), 15m-2h 31/72 (43%
     (note 15m-2h and not 1h)
TIMED-WAIT: >1m 36/72 (50%)
RST: >1m 29/72 (40%)

> please clarify. 

By independent, I mean NB=I from draft-ietf-behave-nat-udp-01 i.e. the
external address and port is determined uniquely by the 2-tuple (source
address and port) of the packet initiating the flow. If a host uses
LA:LP to connect to RA1:RP1 as is allocated the mapping MA:MP, then when
the host uses LA:LP to connect to RA2:RP2, it will be allocated the
mapping MA:MP as well. As for the numbers, I get 53/78 (63%) for
"Independent" ... unintentional inclusion the non NAT'ed or DMZ'ed hosts
artificially inflated the previous estimate. The other classifications
in this category "Address", "Port", "Session" and "Address and Port" are
explained in http://nutss.gforge.cis.cornell.edu/stunt-client.php

> I am a concerned if the results are representative of the NAPT devices
> profile.

While almost all results are from NAPT devices, they may not be
representative of the global NAT deployment. For instance, according to
market surveys, NATs from Buffalo Technologies is more common than D-
Link and Netgear, however our sample set does not reflect this.

-- 
Saikat
Attachment:
signature.asc