Subject: Re: [midcom] WG scope/deliverables

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 15 Feb 2001 14:51:53 -0500

In message <[email-masked]>, Ed Gerck writes:

>
>Actually, in the UK you can do just what you wish ;-)
>You give a name to your house (say, "The Tulip") and
>the post office knows where The Tulip is. If you move,
>you can do the same at your new location, provided
>there is no conflict.  This seems to be more similar to the
>notion of using an IP number as a name -- but isn't this
>why we need DNS? ;-)
>

And if you move from London to Belfast, this will still work?  
Relevance left as an exercise for the student.

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: Ed Gerck <[email-masked]>
Date: Thu, 15 Feb 2001 15:41:31 -0800

> And if you move from London to Belfast, this will still work?

In the UK, as I said.  I would think that other countries may have
a similar system. Note that this is a natural example of NAT,
in which the post office is doing the address translation to a local
address that only that post office knows, but which is globally
reachable through that post office.  And the post office does so
without changing the global addresses or the local addresses.

I don't want to be philosophical about this, but IMO this example
actually supports the view that NATs are naturally occuring solutions
to provide for local flexibility without decreasing global connectivity.
The Internet NAT is perhaps less an "invention" than a  translation of
an  age old mechanism that we see everywhere.  We use the same
principle for nicknames in a school for example.

IMO, it is thus artificial to try to block Internet NATs.  Far better would be
to define their interoperation with other network components that we also
need to use, in each case.

Cheers,

Ed Gerck

---

From: Steve Deering <[email-masked]>
Date: Thu, 15 Feb 2001 17:46:46 -0800

At 3:41 PM -0800 2/15/01, Ed Gerck wrote:
> > >there is no conflict.> >
>...Note that this is a natural example of NAT,

They also do it without removing the original destination address and
replacing it with another one --  the original envelope arrives at the
house with the destination address still saying "The Tulip", i.e., it
has not been translated, and thus is not analogous to NAT.

If delivery is accomplished by having all the necessary the UK post
offices and postpersons remember a routing from "The Tulip" to its
current street address, then its IP analog is having the routers
within a site maintain a host route for a specific IP address.

If, on the other hand, only the UK-entry post office maintains the
mapping and sticks the original envelope inside another envelope
(or puts a yellow sticky note over the original address), addressed
to The Tulip's current street address, then its IP analog is having
the border router maintain a tunnel to an individual interior host,
encapsulating the original packet with another header.

A closer postal analog to the typical port-and-address-mapping NAT is
a system in which postal envelopes only have room for a street address
or a town name, but not both.  If I send a letter to someone outside
my town, the letter starts off with a return address of:

    Steve Deering
    123 Main Street

and the town's post office overwrites that return address, changing it to:

    Priscilla Presley
    San Jose, CA, USA

and they remember for a while that they did that, so that if my
correspondent decides to reply to that return address, the town post
office knows who it should be delivered to.  (They replaced my name
because someone else named Steve Deering recently sent mail from
another street address in my town, and the only way to keep the
replies separate is to change the name that I will be [temporarily]
known by in the outside world.)

At some point, they discard the remembered mapping, to free up some
names.  Perhaps they do that based on a time-out, in which case the
mapping may disappear before we are finished corresponding, and thus
cause our communication to fail.  Or maybe they open up our letters and
look at the contents to try to identify the final letter of our
correspondence, to guess when we might be done.  Of course that latter
approach doesn't help if they don't understand what language our letters
are written in, so maybe they decide to limit us to only a small choice
of languages, and just discard anything they don't understand.

Furthermore, no one outside my town can initiate a correspondence with
me, unless I work out some arrangement with the post office to get
long term external use of someone's (preferably my own) name.  Or else
I have to go and get a town name for myself.

>to provide for local flexibility without decreasing global connectivity.

Since the example was not an example of a NAT, I don't think it
supports any such view.

However, I suppose a postal system like the one I described might
"naturally occur" as a response to having envelopes that were no
longer big enough to contain full addresses.  But I think it much
more likely that post offices and people would somehow arrange to
just use bigger envelopes, rather than incurring all the extra complexity,
cost, fragility, and loss of functionality of the translating approach,
except as a temporary stop-gap.

Unless, that is, we were talked out of it by folks claiming that
changing the size of envelopes would be an impossibly large task, and
that we're better off anyway with the translating system, because
our personal names and street addresses can be kept secret within our
town, and we can change the name of our town any time we like without
bothering anybody in it.

Steve

---

From: Ed Gerck <[email-masked]>
Date: Thu, 15 Feb 2001 18:21:22 -0800

> has not been translated, and thus is not analogous to NAT.

I think you got the example addresses reversed. In the case I mention,
"The Tulip" is the global address and (for the sake of example) suppose
now that "545 Abbey St." is the local physical address known to the post office.

Thus, when the mailman delivers an envelope addressed to "The Tulip" at
"545 Abbey St.", that mailman is doing address translation -- and he may
even have written "545 Abbey St." on the envelope as a reminder.  So,
when the original envelope arrives at the destination address it did so not
because it had "The Tulip" written on it but because the post office was
able to do address translation to the *current* location which is "545 Abbey St."

If another location is assigned to "The Tulip" (for example, because the owner
Mr. Tulip moved), the post office will deliver the original envelope there and
not at "545 Abbey St."

Note that the local address which only the post office (and Mr. Tulip) knows is
"545 Abbey St." while the global address is "The Tulip".

In Internet NAT terms, "The Tulip" is the globally routable IP number for my DSL,
the post office is my NAT box and the physical address "545 Abbey St." is the
local, non-routable IP number of my host A.  For my other hosts, I simply tell
the NAT box (post office) what is the local IP number that will receive the next
packet for "The Tulip" -- my single global name.  If now you add a mailbox number to
"The Tulip" you have the same functionality of port translation as well, where
different local addresses (for private mail, for example) will correspond to different
"n" in "The Tulip, PO Box n".

In other words, this is a natural NAT example and clearly  supports the view that
NATs are naturally occuring solutions to provide for local flexibility (Mr. Tulip
can change residence at will and can have more than one recipient for private mail)
without decreasing global connectivity ("The Tulip" is always responsive).

Cheers,

Ed Gerck

---

From: Steve Deering <[email-masked]>
Date: Thu, 15 Feb 2001 19:19:16 -0800

>now that "545 Abbey St." is the local physical address known to the post office.

Yes, I understood that.

>even have written "545 Abbey St." on the envelope as a reminder.

No, he's doing address mapping, similar to the the mapping that is
done from an IP address to an Ethernet address to accomplish last-hop
delivery.  The original, globally unique name (The Tulip, UK) is still
present on the letter.  The local address may or may not also be present;
depending on whether or not "encapsulation" (i.e., adding on the
local address) was required to accomplish the delivery.

In the case of NAT, on the other hand, the destination address used
across the public part of the Internet is no longer present in the packet
finally delivered to the destination host -- it has been been replaced
by (i.e., translated to) a different address.

>  So, when the original envelope arrives at the destination address it
>did so not because it had "The Tulip" written on it but because the post
>office was able to do address translation to the *current* location which
>is "545 Abbey St."

No, it was because they were able to do the mapping to the current
location.  Translation, (i.e., replacing the address on the envelope
with another address) is not necessary and not done.  The envelope may
well be *augmented* with an additional address, but the original
address is not removed.

>Note that the local address which only the post office (and Mr. Tulip) knows is "545 Abbey St." while the global address is "The Tulip".

The important point is that Mr. Tulip knows *both* addresses, and can
tell his international correspondents what his globally-unique address is.
A host behind a NAT, on the other hand, doesn't know its own global
address and, in most cases, doesn't even have a global address (or one
port's share of a global address), except temporarily as a side-effect
of sending a packet to the outside world.

>In Internet NAT terms, "The Tulip" is the globally routable IP number for
>my DSL, the post office is my NAT box and the physical address
>"545 Abbey St." is the local, non-routable IP number of my host A.

That would be analogous to having "The Tulip, UK" be the address of
a post office, with all houses served by that post office sharing
the same global address of "The Tulip, UK".  That indeed is like a
NAT, but is not the same as the original example.

>In other words, this is a natural NAT example...

The original example, of a single house with the global address of
"The Tulip, UK"  is a naturally occurring example of something like ARP
or something like tunneling, not something like NAT.  The distinction
is betweeen doing a mapping/encapsulation and doing an address
substitution.  NATs are all about doing address substitution; the
post office does mapping/encapsulation to deliver to The Tulip.

Steve

---

From: Keith Moore <[email-masked]>
Date: Thu, 15 Feb 2001 22:33:52 -0500

> without changing the global addresses or the local addresses.

I think the example you give is more like ARP or VLAN than NAT. 

If the postal service were NATted, you'd send your mail to the post 
office, the mail clerk would decide that you really intended it
to go somewhere else, and would erase your original destination
and return addresses and fill them in with something different.
Any address that you actually put in the text of the message would
be useless to the recipient.  Similarly, business cards, telephone
directories, or any other means used to look up addresses outside
of the postal service's control, would be useless.  Each post office 
would need to have its own telephone directory for every telephone 
with which that you might want to call, so that you could look up 
a telephone number using your local post office's spelling of the 
address.  If you moved from one place to another, such that you were 
now using a different post office than before, you wouldn't be able 
to continue using snail-mail to correspond with anyone with
whom you'd previously been corresponding, because you would no 
longer have a usable address for that person.

Keith

---

From: Ofer Inbar <[email-masked]>
Date: Thu, 15 Feb 2001 22:37:58 -0500

> able to do address translation to the *current* location which is "545 Abbey St."

That still doesn't sound like NAT.  A complete address which specifies
your town and house name, is global, and has a one to one mapping with
your house.  Your house can both initiate communication and receive
communication initiated by others, at that address, and no other house
uses that address.  No rewriting of envelopes is done, and no
disruption of the "end to end" nature of addressing is involved.

The fact that your address actually has to be silently translated to
another address by the post office, at the local hop only, and
*invisibly* from you and your correspondents, makes this a natural
example of protocol layers, not of address translation.  It's as if
"1234 Foo Street" is your MAC address, and "Tulip, BarBurgh, Scotland"
is your IP address.  The local post office, and *only* the local post
office, needs to keep a mapping between street addresses and house
names, for their town (aka segment or LAN).  You only know your own
street address and your own house name.  And you never (need) use your
street name in any communication, only in communication management
(i.e. telling the postal system that you've moved).

Layering most certainly *does* occur naturally in communication.
That's why the best tutorials that try to explain protocol stacks and
layers to non-technical people, usually make analogies to things like
postal mail, or to bosses who communicate via secretaries who can
freely change between fax or mail without changing the content of the
messages exchanged by their bosses.

NAT, as far as I can tell, is pretty much always a kludge, whether
it's natural or not.  It doesn't make people happy unless obscurity
and reduced communication is what they're explicitly seeking.

  --  Cos (Ofer Inbar)              --  [email-masked] [email-masked]
  --  Exodus Professional Services  --         http://www.exodus.net/
  "OSI is a beautiful dream, and TCP/IP is living it!"
   -- Einar Stefferud <[email-masked]>, IETF mailing list, 12 May 1992

---

From: Ed Gerck <[email-masked]>
Date: Thu, 15 Feb 2001 21:45:11 -0800

Steve Deering wrote:

> ...

To be precise and still with the original example, the analogy is that
"The Tulip, CMZ 62N, UK " is the full global address (which was described
in the context of my email as  <"The Tulip" at that post office>).
The full designation "The Tulip, CMZ 62N, UK" is thus similar to a globally
routable address (Internet IP) that is available at the post office
"CMZ 62N, UK" (NAT box) and which may at times correspond
to a house at "545 Abbey St" (host A) or to a house at "636 North Av"
(host B), which mapping that post office knows at each time and uses
to direct correspondence to the proper house without revealing to the
outside world what that local address might be  -- ie, either "545 Abbey St."
(host A) or  "636 North Av" (host B), or any other.

All houses served by that post office share "CMZ 62N, UK" while the house
name is similar to a port number in NAT (different for each house being served).

Note also that my NAT analogy only dealt with receiving mail, not sending mail.
Mr. Tulip may send mail any way he wishes, with a global return address as
"The Tulip, UK", with a local address as "545 Abbey St", with a fake return
address or even with no return address.

Let me now address your objection that  "A host behind a NAT, on the other hand,
doesn't know its own global address and, in most cases, doesn't even have a
global address (or one port's share of a global address), except temporarily as a
side-effect of sending a packet to the outside world". We may agree that
we are dealing here with two different processes -- sending information and
receiving information.  An UK post office  was presented as a NAT analogy
for receiving information, not to send information.  In receiving information,
Mr. X  (a host behind the NAT) does not need to know how the house
he just moved in is named at the post office -- and, nonetheless, he will get
any letters addressed to "The Tulip, CMZ 62N, UK" if that is the house's name at
the post office "CMZ 62N, UK". The temporary property of the global address is
also present in the UK post office example for receiving information -- just that
the time scale may be hundreds of  years, not milliseconds.

Your other objection was that "In the case of NAT, on the other hand,
the destination address used across the public part of the Internet is no longer
present in the packet finally delivered to the destination host -- it has been
been replaced by (i.e., translated to) a different address".  My reply is
that this does not occur in NATs if the destination address is also included
in the packet payload, which is the case here -- the envelope is part of
the message's payload in the post office case. Pls see also my last comment,
below.

> or something like tunneling, not something like NAT.

I agree that you can define many different analogies, from that example. But,
as above, if you consider the way that information is received then a NAT box
is IMO one valid analogy for reception because it satisfies the functionality
observed in a NAT box when receiving packets.  Yes, the UK post office does
not erase the global address on the envelope but a NAT will also keep that
information in the translated packet if it is in the packet's payload (which
is the case for the letter's envelope), and without any impact in its functionality
as a NAT.

> The distinction is betweeen doing a mapping/encapsulation and doing an
> address substitution.  NATs are all about doing address substitution; the

At the post office routing level, letters that enter a common input bin are moved to
different output bins at the post office. The common input bin is a globally
routable address such as "The Tulip, CMZ 62N, UK", "The Raven, CMZ 62N, UK",
etc. -- where the only part that is globally meaningful is "CMZ 62N, UK".  Each
output bin corresponds to a local address mapped from the local qualifier
"The Tulip", "The Raven", etc. Each output bin, however, has no marking for
any local qualifier ("The Tulip"), just for a local address ("545 Abbey St").
Thus, there is no encapsulation at the post office routing level -- anyone
looking just at the bin "545 Abbey St" could not tell which local qualifier
was used for the letters inside the bin.

But, what happens if I look at the contents of the bin?  The same happens
with NAT boxes, I note, because the message may contain the destination
IP in its payload and no amount of packet address translation will erase it.
Looking into the bin is the same as looking into the payload.

Cheers,

Ed Gerck

---

From: Steve Deering <[email-masked]>
Date: Fri, 16 Feb 2001 00:07:06 -0800

[I've taken the bulk of my response to Ed's last reply to private
mail, since I assume few here are interested in tedious arguments
about exactly how the Internet is analogous to the postal system,
but I'll just make his one public observation:]

At 9:45 PM -0800 2/15/01, Ed Gerck wrote:
>I agree that you can define many different analogies, from that example.
>But, as above, if you consider the way that information is received then
>a NAT box is IMO one valid analogy for reception because it satisfies
>the functionality observed in a NAT box when receiving packets.

Your postal example doesn't entail the modification of an address on
the received package, which is the defining characteristic of a NAT.

Your postal analogy does show how you can get nice properties of
address portability and location-hiding within a local network
*without* resorting to address modification, i.e., it shows that
you can have the flexibility you so prize without doing NAT.  Maybe
that's the lesson you should draw from this "naturally occurring"
analog to packet networks.

Steve

---

From: "Melinda Shore" <[email-masked]>
Date: Fri, 16 Feb 2001 06:55:18 -0500

> post office does mapping/encapsulation to deliver to The Tulip.

Number portability is probably a better example - in the
US, at least, the called party's address is swapped out
at the ingress "router" and then swapped back in at the
last hope "router."

Melinda

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 16 Feb 2001 08:09:01 -0600

Ed, you seem to be ignoring the difference between identification,
location, and routing. What the post office does is routing, not NAT.
The NAT problem is a problem because IP addresses mix the concepts
of identification and location in a single bit string. There's nothing
natural about it, at least nothing more natural than shooting
oneself in the foot.

  Brian

---

From: Ed Gerck <[email-masked]>
Date: Fri, 16 Feb 2001 08:12:15 -0800

List:

My example of the UK postal system, with addresses that behave as names,
was NOT an attempt to make a parallel between the postal system and the
full glory of the Internet.  BTW, I don't believe in such parallels. Sorry to disapoint
those that thought so! ;-)

My sole puprose with that example was to show that there is a natural need
for heterogeneous address systems and, therefore, for address translation.
Many features found in Internet NAT are also IMO found in the UK postal
scheme.  The analogy is not perfect (as I said myself) but, what analogy ever
is?

So, rather than trying to find where the analogy is wrong, or claiming that
I am ignoring the difference between  identification, location, and routing,
this dialogue was based on illustrating those two points, to wit:

1. there is a natural need for heterogeneous address systems and,

2. therefore, there is a natural need for address translation.

Nothing else, and nothing more, was claimed.

Cheers,

Ed Gerck

---

From: Steve Deering <[email-masked]>
Date: Fri, 16 Feb 2001 09:20:48 -0800

>1. there is a natural need for heterogeneous address systems and,

Agreed.

>2. therefore, there is a natural need for address translation.

Only if there's some need to interconnect them, and even then only as
a temporary measure, if at all, because there is an alternative and
preferable way to deal with heterogeneous address systems -- and the
only long-term successful way if history is any guide -- which is to
layer a homogenous address system on top of them, which is the basic
idea behind IP.

Yes, the first attempt to join networks using different address systems
is often to install translators, which is the way "interworking" was
done before IP and Pup were invented, the way email systems were
interconnected before universal adoption of the [email-masked] name space,
and the way people are gluing together the phone network and IP phones,
not to mention the IPv4 and IPv6 Internets, today.  Such approaches have
always turned out to be so complex, fragile, unmanageable, unscalable,
and function-limiting that they are sooner or later abandoned in favor
of the one-global-namespace approach.  If people understood that they
didn't "need" to do translation, they just might take that step sooner
and save everyone a lot of grief.

Steve

---

From: Keith Moore <[email-masked]>
Date: Fri, 16 Feb 2001 13:09:32 -0500

> 1. there is a natural need for heterogeneous address systems and,

okay

> 2. therefore, there is a natural need for address translation.

no.  it doesn't follow, at least not in the sense of address translation
as done by NAT.  there is a natural need for *routing* or *mapping*
between higher and lower layer addresses, but this isn't the same thing
as NAT.

Keith

---

From: Dhiman Barman <[email-masked]>
Date: Fri, 16 Feb 2001 23:55:48 +0500

Hi,
  Recently I read some presentation slides at 
http://www.iam.unibe.ch/~braun/talks/swisscom498/ppframe.htm
  on "Differentiated Services of Internet". 
  I am confused with the statements about "Assured Services" 

  1) Users/ISP negotiate service profile
  2) No QoS guarantees but low loss probability
  3) Pkt which dont conform to the service will not be dropped but
     will be made best effort. 

  I see the stmt 2) quite not fitting with others. Am I missing
something ? 

Thanks
Dhiman Barman
Boston Univ 
PhD student
Dept of Computer Science.
-- 
If you only have a hammer, you tend to see every problem as a nail.
		-- Maslow

---

From: Ed Gerck <[email-masked]>
Date: Fri, 16 Feb 2001 17:45:07 -0800

> layer a homogenous address system on top of them, which is the basic

The other way, which can be theoretically justified as well, is to implictly
define a "third system" that defines an internal reference for a set of
relationships between the two address spaces.  This third system
can take the form of a NAT.  Note that this third system is not an address
space, much less a homogeneous one.

And, as "The Tulip" discussion thread showed, such a NAT can take various
forms that could be defined in an RFC with interoperation in mind.  In
particular, the capability of including the outside origin address:port as well as
the global destination address:port in the translated packet which has the usual
NAT-defined local destination address:port and the local origin address:port.

Cheers,

Ed Gerck

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 17 Feb 2001 16:23:51 -0600

You might take that question to the differentiated services
interest list:

  [email-masked]
  Send "subscribe diffserv-interest" to [email-masked]

    Brian