Subject: Re: [BEHAVE] I-D ACTION:draft-gont-behave-nat-security-01.txt

From: Brian E Carpenter <[email-masked]>
Date: Wed, 05 Nov 2008 14:18:52 +1300

Hi,

> 5.1.3.  Type of Service
> 
>    End-systems have traditionally selected different TOS values epending
>    on the nature of the application making use of the IP services.  As
>    the TOS value selected for each packet usually depends the specific
>    IP implementation, this could be exploited to roughly count the
>    number of systems behind a NAT. 

1. It's been called DSCP rather than TOS since RFC2474.

2. The DSCP value is bitwise-encoded, and usually encoded according
to a site-wide policy. So all you can deduce is how many different
DSCP codepoints are included in the policy. That tells you absolutely
nothing about the number of hosts.

> In order to avoid the TOS field from
>    revealing this information, NATs could rewrite the TOS field in
>    outgoing packets according to the Protocol value in the IP header,
>    and the Destination Port value in the header of the transport
>    protocol running on top of IP.

Hold on, that breaks diffserv.

What you could say, consistent with RFC2474, is that the NAT MAY
operate as a diffserv classifier in accordance with the local diffserv
policy. But I think the whole point is wrong anyway.

Also, you need to say something about the ECN bits. I think they
MUST be left unchanged in order not to break ECN.

   Brian

_______________________________________________
Behave mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/behave