Subject: RE: [Ietf-behave] Port scan to and from symmetric NAT'd peers

From: "Francois Audet" <[email-masked]>
Date: Mon, 27 Jun 2005 10:36:35 -0700 (PDT)

> On Sat, 2005-06-25 at 12:54 -0700, David Barrett wrote:
> > Saikat Guha wrote:
> > > the new TCP connection being attempted after all ports had been 
> > > exhausted would timeout
> >
> > What does BEHAVE recommend in this scenario?
> > 
> > Does BEHAVE recommend a minimum 'Max Flows'?
> 
> I don't think the UDP draft has any recommendations that 
> address these issues. François?

No, UDP draft doesn't.

I don't think it should either. Obviously, the maxflow would be dependent
of the NAT deployment. A large Enterprise NAT would have a much different
requirement from a residential NAT.

> > Incidentally, are there NATs with multiple external IPs?
> 
> Mainly corporate NATs, as far as  I know.

Yes, even SOHO NATs. Sometime this is called "IP address pooling".

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Wed, 29 Jun 2005 16:12:40 -0700 (PDT)

> -----Original Message-----
> From: ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx 
> [mailto:ietf-behave-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of 
> David Barrett
> Sent: Friday, June 24, 2005 10:06 PM
> To: 'Behave'
> Subject: [Ietf-behave] Port scan to and from symmetric NAT'd peers
> 
> So I'm about to embark on implementing my symmetric NAT 
> piercing tech, and I'm having trouble learning about how port 
> scans and NATs combine both today, as well as under the IETF 
> BEHAVE recommendations.  Can you help me to understand:
> 
> 1) If a symmetric NAT assigns different external ports to 
> each outgoing UDP request in round-robin fashion, what 
> happens if there aren't enough ports to go around?  How does 
> it pick which mappings to override?
> 
> For example, I am behind a symmetric NAT, and I contact 65537 
> external nodes, there simply aren't enough port mappings to 
> accomodate all sessions.  If it uses a simple "least recently 
> used" approach, would I in effect deny service to every other 
> node behind my NAT (by remapping their ports to me)?  Or is 
> there some kind of hard limit on the number of ports that 
> will be assigned to a given endpoint?

There are NAT implementations that could limit sessions per host/user.
Typically the LRU is driven by a configurable timer which the
draft-sivakumar-behave-nat-tcp-req-01.txt specifies. Even though the
exact timers values cannot be specified in some cases a guideline should
be issued by behave. 

Senthil
> 
> 
> 2) Do symmetric (or any) NATs use the full range (0-65535) of 
> extenal port mappings, or do they avoid certain "special" 
> ranges (such as 0-1023)?  Thus if I'm trying to scan a 
> symmetric NAT to find any nodes behind it, need I (in the 
> worst case) scan the entire range (0-65535) or can I target 
> my scan better?
> 
The implementations differ. Some use the high range of ports and after
exhaustion they move to the next address and use the higher range if
available or try to use the low range of ports. I think there is a lot
of inconsistency in behavior and hence behave should provide some
guidelines. UDP draft provides some guidelines in this context.
 
> 
> 3) Given the fuzzy line between NATs and firewalls, do NATs 
> typically perform any sort of "attack detection" and thus 
> block activities such as port scanning, whether inbound or 
> outbound?  Naturally, this would depend on the 
> implementation, but I'm curious if you are aware of 
> implementations that do this today, or if the BEHAVE draft 
> makes any recommendations around this type of functionality.
> 
> 
> 4) Do you have any advice for me regarding how to effectively 
> pierce symmetric NATs while remaining a "good citizen" of the 
> Internet? 
> Naturally, port-scanning is a horrible solution to the 
> problem of piercing symmetric NATs, but it's the only one of 
> which I'm aware.  Can you offer me any advice on how to 
> target my scan most effectively, structure my scan to avoid 
> setting off any alarms, or do away with the scan altogether?
> 
> 
> Thanks for your help!
> 
> -david
> _______________________________________________
> Ietf-behave mailing list
> Ietf-behave@xxxxxxxxxxxxxxxxxxx
> https://list.sipfoundry.org/mailman/listinfo/ietf-behave
>

---

From: "Senthil Sivakumar (ssenthil)" <[email-masked]>
Date: Thu, 30 Jun 2005 06:49:44 -0700 (PDT)

Senthil