Subject: [BEHAVE] Revealing identity of TCP client connection when sharing IPv4 address

From: "Dan Wing" <[email-masked]>
Date: Wed, 25 Aug 2010 15:10:29 -0700

Please send replies to [email-masked]

Hi.  

Andrew and I have written two I-D's describing two approaches to solve a
problem that occurs when sharing an IPv4 address (NAPT44, NAPT64, HTTP
proxy, A+P, dual-IVI, etc.).  The abstract is common between the two
approaches and summarizes the problem:

   When an IP address is shared among several subscribers, it is
   impossible to  determine which subscriber has initiated that TCP
   connection.  This memo describes a technique to share the identity of
   a subscriber that initiated a TCP connection with the TCP server.
   The proposed method avoids altering the application-level payload
   and works well with SSL-protected connections.

approach 1, new TCP option:
  http://tools.ietf.org/html/draft-wing-nat-reveal-option

approach 2, overload existing TIMESTAMP TSVal option and IP ID:
  http://tools.ietf.org/html/draft-yourtchenko-nat-reveal-hash

We are leaning towards the new TCP option (approach 1).

The idea crosses BEHAVE (NAT), INTAREA (address sharing), and TCPM (TCP
option).  However, to reduce cross-posting and because INTAREA already has a
working group document related to address sharing, I propose we discuss the
document on the [email-masked] mailing list.

Comments and feedback welcome.
-d