Re: [Tsvwg] NATs (etc.) (was Re: WGLC for Port Randomization starts now (April 1st))

[Fernando Gont <[e-mail]>]

Mark Allman wrote:

>>>   - Further in 3.3.1 you note that web proxies and NATs are examples of
>>>     systems that "create many connections from a single local IP address
>>>     to a single service".  I think that's pretty dubious.  You might say
>>>     that they make more connections to popular services than end hosts
>>>     do (because of the aggregation) and thus increase the population of
>>>     used ephemeral ports and hence the chance of collision using Alg. 1
>>>     or 2.  But, I think it's sort of dubious to just leave it hanging as
>>>     these things hit the problematic case as a matter of course, which
>>>     is not generally true, I bet.
>> This is the scenario that lead to users of FreeBSD and OpenBSD to hit
>> the aforementioned problem. And what led FreeBSD to disable port
>> randomization when the connection-establishment rate is "high".
[....]
> I am not familiar enough with the FreeBSD/OpenBSD experience.  But,
> you're formulation is pretty tightly scoped.  If there is some box
> making a bajillion connections to some service then sure... the port
> space is going to be used and it is going to be more difficult to choose
> additional ports.  But, I don't see that as the norm.  I think the
> formulation I sketch that NATs (proxies, etc.) create more contention by
> aggregating multiple peers into one port space is a reasonable point to
> make.  And, in fact, is shown in the data.  

I agree with this.


> But, the data also shows
> that even in this case the collision rate is very low.

This is the one I'm not sure about. Yes, I believe in the result of your
research. However, can we really assume that the network scenario in
which you measure connections really represents most network scenarios,
and that therefore we can broadly claim that "collision rates resulting
from NATs are very low"?

I'm not saying that is not the case. I'm just wondering whether it would
be appropriate that the data we have represent mosts network scenarios.

e.g., it is not unusual to have a large number of clients behind a NAT
connecting every few seconds to a mailserver on the public side of the
NAT.This may be a dumb thing to do... but it does happen.

Thoughts?

Thanks,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1