Re: [Tsvwg] NATs (etc.) (was Re: WGLC for Port Randomization starts now (April 1st))

[Fernando Gont <[e-mail]>]

Mark Allman wrote:

[....]
>> e.g., it is not unusual to have a large number of clients behind a NAT
>> connecting every few seconds to a mailserver on the public side of the
>> NAT.This may be a dumb thing to do... but it does happen.
>>
>> Thoughts?
> 
> I'm not asking you to say that the data in my paper is representative.
> I have repeatedly said that in fact it is two data points and we know
> that the Internet is a widely variable place.  The formulation I give
> above notes that NATs and proxies cause aggregation that the causes
> *more* contention for the port space.  That is reasonable to say.  

Agreed. Will do.



> And,
> in fact, the data in my paper does show slightly more collisions when a
> NAT is assumed because of this aggregation and contention.  What I am
> responding to is this wild notion that somehow NATs and proxies are
> going to *dramatically* effect things.  Certainly they *can*.  And,
> certainly any one of us could *dream* the scenario where it might
> happen.  But, to repeat, I don't think we should be basing our decisions
> here on dreams or handwaves.

I wil review the text. What I meant is that they *can*.. not that they
"will".



> (And, also note that as I noted in [Allman] one could view a quite busy
> NAT or proxy as not being all that vulnerable to these sorts of attacks
> anyway just because their normal port allocation---say using the
> traditional BSD scheme---moves fast enough and involves enough remote
> IPs that blind attacks are naturally mitigated.)

Agreed.

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1