Re: [v6ops] How can one check the presence of IPv4aaS technologies? -- Re: draft-vf-v6ops-ipv6-deployment

[[e-mail]]

> Of course, all five IPv4aaS technologies try to imitate the situation of carrier grade NAT for IPv4. The question is, whether the user can point out the fact the an IPv4aaS technology is used, and possibly also determine its kind.

While 464XLAT and DS-lite are based on CGNs that's not the intention nor implementation of MAP/LW46.

> Now, again, we may distinguish two cases:
> - If the user can observe the traffic on the outside (WAN) interface of the CPE (e.g. using tcpdump, tshark, etc.), then it is quite easy.
> - If the user cannot do that, then it is really interesting.
> 
> Can anyone recommend a suitable method for the second case?
> 
> Do you know such properties of the user side behavior (e.g. traffic pattern) of any of the 464XLAT, DSLITE, MAP-E, MAP-T or lw4o6 technologies that could indicate their presence?

Assuming you can also observe traffic on a outside host.

You can use various NAT detection techniques.
See if you see common bits between the users IPv6 address and the outside IPv4 address.
See if ports are restricted and try to identify the port allocation algorithm used.
Although the MAP PSID algorithm might also be used by NAT444 CGNs.
You can see if you get IP options or DF flag behaviour to detect translation.

It's going to be a bunch of heauristics thought.
Even the MTU difference between v4 (encapsulated or translated) and v6 could be masked by the ISP.

Cheers,
Ole