Subject: [shara] playground for port restricted IP with ping, traceroute and ftp -A

From: Masataka Ohta <[email-masked]>
Date: Thu, 03 Feb 2011 19:24:22 +0900

Dear all;

I have set up an environment in which you can try to use port
restricted IP with end to end transparency.

Though my implementation is with end to end NAT, it should
be able to interoperate with A+P and/or PE-ARP based system,
if some of you implement them and ICMP ID and sequence
numbers are appropriately treated as port numbers.

There are two private networks with two gateways (enatg1, enatg2).

Private network behind enatg1 has two end-to-end-NAT-aware hosts
(enate1 and enate2) and a normal router (e2enatgwp).

Private network behind enatg2 has an end-to-end-NAT-aware host
(enage3).

                  public internet
                       |
--------+--------------+------------------+------
        | 131.112.32.141                    | 131.112.32.142
      enatg1                              enatg2
        | 192.168.1.1                       | 192.168.1.1
--+-----+----------------+-------        ---+---
  | 192.168.1.2          | 192.168.1.3      | 192.168.1.2
enate1                e2enatgwp           enate3
(port 100, 200, ...,     | 192.168.2.1   (port 100, 200, ...,
of 131.112.32.141)    ---+---            of 131.112.32.142)
                         | 192.168.2.2
                      enate2
                      (port 150, 250, 350, ..,
                      of 131.112.32.142)

you can login all the hosts with user name and password of "guest".
e2enatgwp may be logged in indirectly from other hosts shareing
a private network.

You can use traceroute (optionally with "-I")

	enate2% traceroute -q 1 -n -p 31000.100 131.112.32.142
	 1  192.168.2.1  0.484 ms
	 2  192.168.1.1  0.651 ms
	 3  131.112.32.142  2.078 ms
	 4  131.112.32.142  2.487 ms
	enate2% traceroute -q 1 -n -p 31000.100 131.112.32.142

and see details with tcpdump

	enatg1% tcpdump -l -vvv -n -i wm0 icmp

					Masataka Ohta

---

From: Masataka Ohta <[email-masked]>
Date: Sat, 05 Feb 2011 08:16:06 +0900

> e2enatgwp may be logged in indirectly from other hosts shareing

Oops, I should have mentioned that all the hosts are running
sshd (at ports 100, 150 and 100 on enate1, enate2 and enate3,
respectively and at default port 22 on other hosts).

You can directly login from your host to enate1 with

	yourhost% ssh -p 100 -l guest 131.112.32.141

						Masataka Ohta