Subject: RE: [Ieprep] Understanding Congestion

From: "Nguyen, An" <[email-masked]>
Date: Wed, 18 Dec 2002 13:53:09 -0500

Bill,

>-----Original Message-----
>From: Bill Woodcock [mailto:[email-masked]]
>Sent: Wednesday, December 18, 2002 11:54 AM
>To: King, Kimberly S.
>Cc: [email-masked]'
>Subject: RE: [Ieprep] Understanding Congestion
>
>
>      On Wed, 18 Dec 2002, King, Kimberly  S. wrote:
>    > Firewalls...how many user sessions are behind a single /32?
>
>That's a NAT function rather than a firewall function, of course.  If
>someone is foolish enough to use a NAT, there's little that anyone can do
>to help them.

NAT comes in two flavors: static and dynamic. If using NAT is not a good
thing to do, what can be used instead for network security?

An

_______________________________________________
Ieprep mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ieprep

---

From: Bill Woodcock <[email-masked]>
Date: Wed, 25 Dec 2002 18:22:37 -0800 (PST)

> thing to do, what can be used instead for network security?

That question implies that NATs have something to do with security, which
they don't.  NATs are a hack which equipment vendors created in response
to artificial scarcity of IP addresses which marketing idiots in some ISPs
dreamed up as a way of getting back towards profitability after they
priced transit too low in hopes of attracting customers away from
competitors who were themselves already selling transit below cost.  It's
just an arms-race between ISP marketing folks and equipment vendors.
That's where dynamic NAT came from as well...  It was a successful attempt
to break the already-deployed NAT boxes.  However, it backfired, because
equipment vendors _like_ it when you break their already-deployed
equipment, since it means that customers have to come back and buy more.
The ISP marketing idiots have since moved on to trying to use legal means,
writing and then attempting to enforce a contractual relationship between
price paid and number of users on the end of a line.  Which is equally
hopeless, but they still refuse to move away from flat-rate pricing, which
is really the root of their problem.  Not that I encourage such a move,
I think their whole posiition is ill-conceived.

If one were to try to dream up some hypothetical relationship between NATs
and security, it would be along the same lines as air-gap.  If you break
the network, traffic can't get through it, and the stuff on one side of
the gap is thus secure against attack from stuff on the other side of the
gap.  Not that that actually secures any of the machines.

If you want security, write some firewall rules, like everybody else.

                                -Bill