Re: [BEHAVE] I-D Action: draft-ietf-behave-nat64-discovery-heuristic-05.txt

[Cameron Byrne <[e-mail]>]

Teemu and team,

Thanks again for working on this.  It is very useful work.

To that end, it is cited in our 464XLAT work
http://tools.ietf.org/html/draft-mawatari-v6ops-464xlat-00 , and the
ideas have been included in 464XLAT Android code
http://code.google.com/p/android-clat/

I am glad the DNSsec work is evolving, it think this be a very
meaningful contribution.  My comments are as follows:


1.  "the information learned enables applications and
   hosts to perform local IPv6 address synthesis and on dual-stack
   accesses avoid traversal through NAT64."

Can we generalize this further?  You say applications and host, but i
am thinking home gateways as well. Perhaps say "enables software to
perform local IPv6 address synthesis..." ?  You also use the term
"node" in the draft, that may be a good fit.


2.  "Furthermore, the host SHOULD cache the replies it
   receives and honor TTLs."  Which TTL?  The TTL or ipv4only.arpa
that is used for discovery?  Are you saying the discover of the PREF64
is bounded by a TTL?

3.  The term NAT64 Prefix is used in this draft.  Would it be better
to use the term Pref64 that is used in RFC 6146 and 6147?  Is NAT64
FQDN in section 3.1.1 the same thing?

4.  Do you see any challenges for validating ULAs as the Pref64 with DNSsec?

5. "The host then does an
   A query of that hostname, which returns one or more A resource
   records, which are the IPv4-facing IP addresses of that NAT64."
What IPv4 address of the NAT64?  RFC 6146 refers to IPv4 transport
address, which i believe are commonly known as the "NAT pool"... do
you mean those addresses?  Since they are tied into the state table,
they are not going to respond to ICMP IPv4 packets.  Also, i dont
think any network operators wants you (or 30,000,000 cell phones)
pinging their NAT box.  There are much cheaper boxes to ping.  This
text needs to be pulled or completely reworked.  I suggest not
treating the topic of connectivity checks at all.

6.  3.1.1 #1 is not clear. Please elaborate on what that FQDN is supposed to be.

7.  Perhaps a state diagram for how DNSSEC validation works with
PREF64 would help.

CB