Re: [P2PSIP] BEHAVE recommends endpoint-dependent mapping, kills p2p-sip?

I just want to second what Enrico and Bruce are saying: I believe we  
can live with
NATs and Firewalls that have endpoint-dependent filtering.

The basics of the idea for how to deal with these are described in  
three drafts
     draft-matthews-p2psip-bootstrap-mechanisms, and
     draft-matthews-p2psip-dsip-nat-traversal      (which Bruce  
already mentioned)
     draft-matthews-p2psip-nats-and-overlays

The first draft describes how a node that wishes to join a peer-to- 
peer overlay
can establish a connection to ONE peer in the overlay.
The second draft describes how the node can then leverage this  
connection
to establish a partial mesh of connections to other peers, and then  
use this
partial mesh to route messages through the overlay.
The third draft attempts to explain this idea and compare it with  
other approaches
to NAT Traversal for peer-to-peer networks.

There is still more work to do flesh out all the details, but I  
believe the drafts
adequately describe the core of the idea.

There was a hot debate in the BEHAVE group on the filtering issue.
However, the key fact is that there are many, many NATs today
that already implement endpoint-dependent filtering for "security"  
reasons,
and it was felt that many manufacturers would just ignore the  
recommendation
if the document said "NATs MUST have endpoint-independent filtering".

- Philip

On 18-Apr-07, at 03:58 , Enrico Marocco wrote:

> Barrett, David wrote:
>> So I'm behind the times, but I just became aware that the BEHAVE  
>> group,
>> which is the IETF group dedicated to specifying future NAT behavior,
>> decided in 8/2005 to recommend that NATs by default implement
>> "endpoint-dependent" (aka "restricted cone") filtering.
>
> Exactly, "filtering", not "mapping" as in the subject.  They are very
> different things and, in fact,  RFC 4787 explicitly requires
> endpoint-independent mapping".
>
>> Basically, all decentralized P2P networks would stop working as the
>> ratio of "accessible" to "inaccessible" nodes trends toward zero.  At
>> that point, basically no DHT can possibly function because nobody can
>> accept unsolicited incoming connections.
>
> Not true.  In some DHTs, e.g. CAN, nodes use just a pretty stable  
> set of
> persistent connections and do not need to receive unsolicited  
> messages.
>   If NATs /behave/, what is needed is just a small set of  
> "unrestricted"
> peers providing the rendezvous service needed to establish persistent
> connections between natted peers.
>
> -- 
> Ciao,
> Enrico
> _______________________________________________
> P2PSIP mailing list
> P2PSIP@ietf.org
> https://www1.ietf.org/mailman/listinfo/p2psip

_______________________________________________
P2PSIP mailing list
P2PSIP@ietf.org
https://www1.ietf.org/mailman/listinfo/p2psip