Subject: Re: Netmeeting - NAT issue

From: "J. Noel Chiappa" <[email-masked]>
Date: Tue, 19 Mar 2002 20:39:41 -0500

> From: Keith Moore <[email-masked]>

    > it seems disingenuous to blame the NAT problem on users when the NAT
    > vendors are doing their best to mislead users about the harm that NAT
    > does.

Oh, piffle. NAT's don't "harm the Internet", any more than a host of other
things: "invisible" Web caches, ISP packet filtering (I can't run an SMTP
server because my cable ISP are a bunch of fascist morons, so I have to run
'fetchmail' instead - which generates *more* traffic - but I digress), etc,
etc.

Many of those are far more problematic *in practise*, but don't seem to
generate anything like as much heat. (And I won't even get into policy
stupidity relating to the Internet, such as the way in which some large
commercial entities are using trademark and copyright law, the DMCA, etc as
blunt instruments to bulldoze small players - the ToysRUs attack on the
people running BondageToysRUs being merely the latest example to come to my
attention.)

There are a number of good technical reasons for down-marking NAT's, but they
aren't as terminally serious as some people claim, looked at from a far-off
stance.

E.g. they do increase the fragility of the network, by moving state away from
the endpoints. However, the pure end-end model (where all the intelligence is
in the endpoints, and everything in the middle is dumb as a post) is too
simple for today's network anyway - security alone demands that we be able to
move some functionality to a "site border router", or some such. And in
practise, the fragility of my NAT box is far less than the fragility of the
routing - something that nobody seems to be anything like as greatly
exercised by. So I discount that one. Etc, etc.

All of which leads me to a simple conclusion: one big reason that you and any
number of other people are upset about NAT's has nothing to do with their
technical shortcomings. Rather, what gets people so aggravated is that they
are killing off the "preferred" alternative.

About which, let me also observe that that alternative is (in effect) a
return to a misty golden age where IPvN was carried everywhere with no
interference. Well, those days are gone forever.

	Noel

---

From: "Tony Hain" <[email-masked]>
Date: Tue, 19 Mar 2002 19:01:14 -0800

Noel Chiappa wrote:
> ...
> security alone demands that we be able to
> move some functionality to a "site border router", or some
> such.

Why does security demand an external border?  Is that based on the
assumption that the host is too stupid to protect itself? If it is based
on having an app listening on a port with the intent of local use, but
expecting a border device to protect that app from remote use (or
abuse), is that the right deployment model? Is the lack of a clear IPv4
way to identify locality at the root of your claim?

Tony

---

From: Keith Moore <[email-masked]>
Date: Tue, 19 Mar 2002 22:17:43 -0500

> things: 

the fact that other things do harm doesn't mean that NATs don't also
do harm, or that the harm done by NAT is somehow lessened or excused.
and IMHO most of the other things you mentioned do less harm than NATs,
though I agree there are a lot of folks out there who are getting away 
with screwing the net.

> are killing off the "preferred" alternative.

The reason I'm upset about NATs is that they make it difficult to
build distributed and peer-to-peer apps, and they encourage a model
where the net is centrally controlled (not by a single center, but 
by a relatively small number of providers who control the center).  

I didn't get seriously interested in IPv6 until I realized that they 
were the most likely viable solution to the NAT problem.   In hindsight
I would have done IPv6 somewhat differently.  But it's possible to start
IPv6, make applications work with it, and maybe fix a few things about
v6 along with way as people learn more about its shortcomings.  NATs,
on the other hand, are completely intractable.  e.g. even if you can 
come up with a better solution to the firewall access problem (and
I think that's possible, though we're nowhere close to that now), as
long as you have NATs you're still stuck with the problems inherent 
in a partitioned address space.  

Keith

---

From: [email-masked]
Date: Wed, 20 Mar 2002 00:27:53 -0500

> assumption that the host is too stupid to protect itself? If it is based

Yes.

The host may be too stupid to protect itself - read Bugtraq or other similar
lists for the gory details.

In addition, an external border is useful as a checks-and-balances, for the
same sort of reasons why the person balancing your company's books shouldn't
be the guy writing the checks, or having Customs inspectors at the border
crossing - what percent of the people on international flights understand
the rules about carrying live biologicals (both animal and vegetable) for
any country they may be visiting?
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: "Tony Hain" <[email-masked]>
Date: Wed, 20 Mar 2002 08:23:15 -0800

> lists for the gory details.

The fact that many hosts are too stupid to protect themselves is not a
reason to architecturally require that the border provide security. The
marketplace may find an opportunity there, but 'the right thing' is to
set the expectation that self defense is the requirement.

> be the guy writing the checks,

Since I do both, I have a hard time agreeing with this analogy. Also if
you start down this path as justification for a filtering router as a
security device, there needs to be an external auditor in the picture.
Where is that service in the average NAT?

> or having Customs inspectors at the border

This argument has some level of merit, but has the orientation
backwards. The border guard is not there to protect the traveler who
might be inadvertently (or maliciously) carrying contraband substances
across the border. They are there because it is cheaper to have a few
educated guards than to continually educate the entire internal
population on proper isolation and disposal. Since software doesn't have
the same attention variability over time as humans, or the continual
churn in education level for each generation, there is reason to believe
that eventually self protection could be cheaper than the overhead of a
collection of border guards.

My question was directed at Noel's assertion that security requires a
site border router as the implementation. Just because that may be
cheaper than fixing all the current hosts, wouldn't we be better off in
the long run if all future hosts protected themselves?

Tony

---

From: "Vivek Gupta" <[email-masked]>
Date: Wed, 20 Mar 2002 14:18:31 -0500

That sounds like running away from the problem .....
U have enough IP addresses so not to worry about it ...
Deployment of that is going to take some time .... and how many ISP's
provide that ...???
IPV6 is running away from current problem .... not the solution ......
Vivek

---

From: james woodyatt <[email-masked]>
Date: Wed, 20 Mar 2002 11:45:23 -0800

On Tuesday, March 19, 2002, at 07:17 PM, Keith Moore wrote:
>
> [...] The reason I'm upset about NATs is that they make it difficult to
> by a relatively small number of providers who control the center). [...]

I sympathize completely.  I'm upset too.

However, I would observe that an architecture that requires an 
application layer gateway in the customer premises equipment at every 
site demarcation point is one we've all seen before [*].

We should not be surprised that such an architecture leads to a network 
that is effectively controlled by a small number of powerful service 
providers.  It should seem eerily familiar by now.

I continue to hold the opinion that the widespread use of NAT in the 
Internet is actually a sign that the IAB may have finally lost the first 
round of the game, and I prefer to interpret the slow pace of IPv6 
deployment simply that round two hasn't started yet.

So.  Where is the hole in IPv6 that will allow a small number of 
powerful service providers to obtain effective control of the network by 
requiring an ALG in the CPE at every site?  I know it's not the address 
space.  Maybe it's in the admission control policy.  I don't know.  I'm 
not really very smart, so I need some help here.

Has anybody done a threat analysis?  If so, can I read it?

--
j h woodyatt <[email-masked]>

[*] I think Steve Deering has made a similar observation.

---

From: Aaron Falk <[email-masked]>
Date: Wed, 20 Mar 2002 13:48:48 -0800

> the long run if all future hosts protected themselves?

Tony-

I think one can make the case that having border protection may
prevent a DOS attack from consuming interior network resources and
allowing interior hosts to communicate amongst themselves.  We've
recently had some fierce DOS attacks on our ISP but I'm still able to
run NFS without a problem. This is a good thing.

---aaron

---

From: "Tony Hain" <[email-masked]>
Date: Thu, 21 Mar 2002 07:39:00 -0800

Aaron Falk wrote:
> allowing interior hosts to communicate amongst themselves.

And if your interior network resources are less than 10x your external
resource, you have an unusual network indeed. Yes it may be more
convenient to have the border deal with DOS, but is it *required* as
Noel asserted?

> We've

NFS & 'good thing' are a matter of personal opinion. In any case if NFS
has trouble running when it has less than 90% of the interior resource,
one might have to question which set of packets should be defined as the
DOS.

Tony