Subject: RE: [Ietf-behave] Requiring NATs to process Out-of-orderfragmente d TCP packets

From: Pyda Srisuresh <[email-masked]>
Date: Mon, 21 Mar 2005 06:09:58 -0800 (PST)

The alternative is to make NAT predictable and work with IP fragments
irrespective of the order in which the fragments arrive.

cheers,
suresh  

--- Francois Audet <audet@xxxxxxxxxx> wrote:
> Agree.
> 
> Those are operational nightmares. I'd rather it just plain doesn't
> work and you have to buy a new NAT. It's a lot cheaper
> than paying people to figure out why it fails
> unpredictably.
> 
> > -----Original Message-----
> > From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx 
> > [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> > Cullen Jennings
> > Sent: Friday, March 18, 2005 17:38
> > To: Bryan Ford; Melinda L Shore
> > Cc: Behave
> > Subject: Re: [Ietf-behave] Requiring NATs to process 
> > Out-of-orderfragmented TCP packets
> > 
> > 
> > On 3/17/05 7:18 AM, "Bryan Ford" <baford@xxxxxxx> wrote:
> > 
> > >>> 1. NATs MUST at the very minimum be able to handle a 
> > datagram whose 
> > >>> fragments appear in an arbitrary order on the wire but "all 
> > >>> together", not intermixed
> > >>> with fragments of other datagrams.
> > 
> > This sounds like a very contrived sort of scenario - image I 
> > had a application that worked when it was the only 
> > applications, but then periodically failed when other 
> > applications where behind the same NAT. This does not sound 
> > like a good situation.
> > 
> > I'm not really in agreement with requirements that make NATs 
> > do something that helps some of the time but don't solve any 
> > problem for the application a bunch of the time.
> > 
> > Cullen (not as chair) _______________________________________________
> > Ietf-behave mailing list
> > Ietf-behave@xxxxxxxxxxxxxxxxxxx 
> > https://list.sipfoundry.org/mailman/listinfo/ietf-behave
> > 
> > 
> > _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>

---

From: Cullen Jennings <[email-masked]>
Date: Mon, 21 Mar 2005 19:41:55 -0800 (PST)

There are several mentions on the thread of alternatives that no client
software can count on so they don't help much. There are also alternatives
that have a trivial DOS attack against the NAT. If you have an alternative
that solves this problem and does not have the trivial DOS attacks against
the NAT, I think people would be interested in it but as far as I can tell
from the list traffic, people don't get what that proposal is yet.