Re: [P2PSIP] BEHAVE recommends endpoint-dependent mapping, kills p2p-sip?

[Cullen Jennings <[e-mail]>]

I agree with Philip. And I think we have plenty of examples that show  
what he is saying is true.

Cullen <with my individual hat on>

On Apr 18, 2007, at 5:18 AM, Philip Matthews wrote:

> I just want to second what Enrico and Bruce are saying: I believe  
> we can live with
> NATs and Firewalls that have endpoint-dependent filtering.
>
> The basics of the idea for how to deal with these are described in  
> three drafts
>     draft-matthews-p2psip-bootstrap-mechanisms, and
>     draft-matthews-p2psip-dsip-nat-traversal      (which Bruce  
> already mentioned)
>     draft-matthews-p2psip-nats-and-overlays
>
> The first draft describes how a node that wishes to join a peer-to- 
> peer overlay
> can establish a connection to ONE peer in the overlay.
> The second draft describes how the node can then leverage this  
> connection
> to establish a partial mesh of connections to other peers, and then  
> use this
> partial mesh to route messages through the overlay.
> The third draft attempts to explain this idea and compare it with  
> other approaches
> to NAT Traversal for peer-to-peer networks.
>
> There is still more work to do flesh out all the details, but I  
> believe the drafts
> adequately describe the core of the idea.
>
> There was a hot debate in the BEHAVE group on the filtering issue.
> However, the key fact is that there are many, many NATs today
> that already implement endpoint-dependent filtering for "security"  
> reasons,
> and it was felt that many manufacturers would just ignore the  
> recommendation
> if the document said "NATs MUST have endpoint-independent filtering".
>
> - Philip
>
>
>
>
> On 18-Apr-07, at 03:58 , Enrico Marocco wrote:
>
>> Barrett, David wrote:
>>> So I'm behind the times, but I just became aware that the BEHAVE  
>>> group,
>>> which is the IETF group dedicated to specifying future NAT behavior,
>>> decided in 8/2005 to recommend that NATs by default implement
>>> "endpoint-dependent" (aka "restricted cone") filtering.
>>
>> Exactly, "filtering", not "mapping" as in the subject.  They are very
>> different things and, in fact,  RFC 4787 explicitly requires
>> endpoint-independent mapping".
>>
>>> Basically, all decentralized P2P networks would stop working as the
>>> ratio of "accessible" to "inaccessible" nodes trends toward  
>>> zero.  At
>>> that point, basically no DHT can possibly function because nobody  
>>> can
>>> accept unsolicited incoming connections.
>>
>> Not true.  In some DHTs, e.g. CAN, nodes use just a pretty stable  
>> set of
>> persistent connections and do not need to receive unsolicited  
>> messages.
>>   If NATs /behave/, what is needed is just a small set of  
>> "unrestricted"
>> peers providing the rendezvous service needed to establish persistent
>> connections between natted peers.
>>
>> -- 
>> Ciao,
>> Enrico
>> _______________________________________________
>> P2PSIP mailing list
>> [e-mail]
>> https://www1.ietf.org/mailman/listinfo/p2psip
>
>
> _______________________________________________
> P2PSIP mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/p2psip

_______________________________________________
P2PSIP mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/p2psip