Subject: RE: Stupid NAT tricks and how to stop them.

From: "Michel Py" <[email-masked]>
Date: Wed, 5 Apr 2006 08:09:51 -0700

Lars,

>> Michel Py wrote:
>> Unfortunately some protocol purity zealots still have to
>> realize that Linksys, Netgear, Belkin and consorts don't
>> sell NAT boxes because they think NAT is good, they sell
>> NAT boxes because consumers want to buy them.

> Lars-Erik Jonsson wrote:
> I do not think consumers in general want to buy NAT boxes, but
> they are forced to do so by ISP's who do not give them a choice.

Your argument does not hold water. Do a survey of customers who have the
"advanced" or "pro" package (with higher speed and multiple static IP
addresses) and you will find that the very vast majority of them (if not
all) use NAT anyway even though they have enough public addresses.

> For ISPs, these restricted connections means users
> have problems running some applications, which
> reduces the traffic they generate.

This does not hold water either. By far, the volume of traffic is
peer-to-peer (mostly questionable in terms of copyright). All major P2P
apps for the most widely used protocols (bittorrent, edonkey etc) cross
NAT nicely, most have UPNP support (no configuration of the NAT box) and
some even have external NAT traversal mechanisms that don't even require
to open a port. Breaking games an other low-volume apps serves no
purpose.

When ISPs want to curb traffic, they either: cap the speed, have monthly
quotas, or (rarely, as it will result in loss of business) enforce their
AUP.

Michel.

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Joe Abley <[email-masked]>
Date: Wed, 5 Apr 2006 11:42:25 -0400

> all) use NAT anyway even though they have enough public addresses.

A survey of users where?

Arguments which shuttle backwards and forwards between people in  
regions with different packaging of internet access services are  
unlikely to bear fruit so long as the arguments concentrate on  
assumptions about packaging.

Different ISPs package access in different ways.

Some do the NAT for you, in their network; some do the NAT in the CPE  
equipment they supply; some don't do NAT for you at all. Some ISPs  
provide only dynamic addresses, and distinguish their packages based  
on speed; some ISPs have the option of static addresses, but only one  
per subscriber; some ISPs can assign a subnet to a customer.

Some ISPs package their access services according to peak speed  
available; some according to a contention ratio within their network  
(or within the telco's network which they use to reach the customer).  
Some ISPs provide a data cap. Some ISPs charge for volume. Some ISPs  
restrict access speed when a volume threshold within a billing period  
has been reached. Some ISPs bill according to data transferred; some  
ISPs bill at a flat rate.

Some ISPs filter traffic towards their customers; some don't. Some  
ISPs (apparently, possibly) deliberately introduce jitter and latency  
into their access products to discourage customers from using VoIP.  
Others don't.

Some ISPs are happy for people to run servers; some are not. Some  
ISPs are happy for customers to announce their own address space to  
them over DSL using BGP (I know this, since I am a customer of one of  
them).

Some ISPs sell symmetric access services; others sell asymmetric  
services. Some use cable; some use DSL; some use fibre; some use  
wireless transmission; some use frame-relay or PPP or HDLC over  
synchronous T1s or E1s.

Some ISPs compete for customers in an open market. Some ISPs don't  
need to, because they have a natural monopoly in access. Some ISPs  
have access to the copper; some ISPs are dependent on wholesale  
products of telcos, and are perhaps limited in what they can provide  
for that reason.

It's a rich tapestry. Assuming that what is available in one region  
implies anything about what is available in other regions is  
unproductive.

Joe

---

From: John C Klensin <[email-masked]>
Date: Wed, 05 Apr 2006 12:43:36 -0400

--On Wednesday, 05 April, 2006 08:09 -0700 Michel Py
<[email-masked]> wrote:

> Your argument does not hold water. Do a survey of customers
> who have the "advanced" or "pro" package (with higher speed
> and multiple static IP addresses) and you will find that the
> very vast majority of them (if not all) use NAT anyway even
> though they have enough public addresses.

It is worth noting in this context that many of the Router
products that are sold for SOHO use (including the high-end
products from the first two vendors listed above) do not provide
any support for multiple static addresses except via one-to-one
NAT.  It is simply not possible to configure those devices to
support use of static public addresses for hosts on the LAN
side.   This situation would somewhat contaminate the results of
the survey you suggest above.

These are not ISP-imposed limitations, but limitations imposed
by commercially-available products.  

It also suggests, again, that part of the current drive by
vendors to support NAT is not because of address shortages but
by support and configuration difficulties with providing and
using small pools of provider-dependent static addresses.

    john

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Wed, 5 Apr 2006 21:15:25 +0200

On 5-apr-2006, at 17:09, Michel Py wrote:

> By far, the volume of traffic is

This sounds a lot like "NAT doesn't really break anything". If I  
pretend I'm a regular user for a minute, I can tell you this is not  
the case. When I used NAT for my Powerbook I had lots of problems  
doing videochats with Apple's iChat with someone else who was also  
behind NAT. Even when I configured the single real IP address I got  
on my Powerbook (very tricky because there was a Cisco SOHO box  
terminating a PPPoA ADSL link in the middle) it still didn't work  
very reliably. RTSP with Quicktime didn't work when the Cisco 82x did  
the NATting, but it would when an Apple Airport Extreme performed NAT.

Peer-to-peer isn't a good example, because of the high built-in  
redundancy. Even someone who can only set up outgoing sessions can  
run BitTorrent without too much trouble because there are plenty of  
peers without NAT or portmappings of some kind (manual, uPnP or NAT- 
PMP) that can receive the incoming sessions. When the sessions are  
up, traffic can flow both ways. However, if you read forums or  
release notes you'll see lots of discussion on port mapping because  
being able to receive incoming session setup attempts means that you  
get to connect to more peers (all of them, without port mapping only  
others that are not behind NAT or do have port mapping) so your  
downloads are faster.

Given the market place realities the IETF should be careful to make  
its protocols interoperate with NAT whenever possible, but don't  
think for a minute that adding NAT workarounds solves the problem  
completely. Here in the Netherlands ISPs generally give out a single  
real IP address to their customers, but most customers use a DSL or  
cable modem with NAT or an additional NAT router or wireless base  
station so they can connect more than one computer. Despite some  
individual reports to the contrary, I believe the same is true for  
most IP users.

However, some ISPs already perform NAT for their customers in their  
network, and that's only going to increase as IPv4 addresses become  
more scarce and eventually run out completely. At that point, many  
people will be behind two layers of NAT. Also, reserving ports will  
be very hard because many systems share one real IP address. Maybe  
it's just me, but I don't see the IETF or anyone else for that matter  
coming up with something that allows communication between two people  
who are both behind two layers of NAT with any modicum of reliability.

So in addition to supporting NAT where reasonably possible, the IETF  
should also continue to plan for a future where there is enough  
address space to make NAT unnecessary. However, universal  
reachability isn't coming back even if NAT is out of the picture  
because people love to run firewalls that break way more stuff than  
intended.

---

From: "John Calcote" <[email-masked]>
Date: Wed, 05 Apr 2006 13:53:11 -0600

-----
John Calcote ([email-masked])
Sr. Software Engineeer
Novell, Inc.
 
>>> John C Klensin [email-masked]> 4/5/2006 10:43:36 am >>

*-------------

I'll just jump in here for a second and mention also that vendors offer what they have to, not what they can. They want to provide the most "bang for the buck", so to speak. These companies don't offer the multiple-static-ip-address option today because most ISP's don't offer it to home users and home (SOHO) users represent the target market. That said, they *would* offer these features if SOHO users were constantly frustrated about the fact that they can't make use of the multiple static addresses that their ISP provides them because of limitations in their router equipment...
 
The fact is, _when_ IPv6 becomes truly mainstream and ISP's begin to offer multiple static addresses because they can, then these companies will offer the features on their routers. 
 
Let's not mistake what the world wants, for what it is successfully living with today.
 
John

---

From: John C Klensin <[email-masked]>
Date: Wed, 05 Apr 2006 18:40:42 -0400

--On Wednesday, 05 April, 2006 13:53 -0600 John Calcote
<[email-masked]> wrote:

> I'll just jump in here for a second and mention also that
> vendors offer what they have to, not what they can. They want
> to provide the most "bang for the buck", so to speak. These
> companies don't offer the multiple-static-ip-address option
> today because most ISP's don't offer it to home users and home
> (SOHO) users represent the target market. That said, they
> *would* offer these features if SOHO users were constantly
> frustrated about the fact that they can't make use of the
> multiple static addresses that their ISP provides them because
> of limitations in their router equipment...  

I mostly agree with this, but point out that at least some of
the problem is that it is not clear that many of these vendors
would actually understand how to offer boxes and support for
multiple static addresses if they decided they wanted to.  It is
clear, as discussed in my earlier note and Iljitsch's comments,
that there are real problems out that.  It is also clear that,
at the price point ("bang for the buck" point) of most SOHO
equipment, providing customer support for static routing or
split-subnet configurations would be insane.

> The fact is, _when_ IPv6 becomes truly mainstream and ISP's
> begin to offer multiple static addresses because they can,
> then these companies will offer the features on their routers. 

Well, I question your "fact".  Opinions clearly differ, but I
would suggest that the evidence so far is that ISPs could offer
multiple static addresses today.  

All of the RIRs claim that they have not turned down any
well-documented requests for IPv4 address that are actually
justified on the basis of network designs and hosts in use.  If
that is true, then, if an ISP wanted to give every household
with machines for each of the parents and one or more for the
children, network-addressable TVs, etc., four or eight public
addresses as appropriate, they could do so.  In general, they
don't, not because they cannot, but because they have
profitability incentives to tie static public addresses to
higher charges and/or commercial services and/or support
concerns about the management of multiple public addresses in
households with multiple machines but a routing-clue deficit.
So, first, I would suggest that, unless the RIRs are lying, ISPs
"can" provide multiple static addresses today.  And they don't,
I believe precisely because of their "bang for the buck"
considerations.

Conversely, one of the reasons those ISPs don't offer multiple
static addresses is that equipment to make them work, and work
well, in the hands of casual users of the Internet is in scarce
supply.  If there are hardware vendors and devices that have all
of the issues figured out --in either IPv4 or IPv6 -- I haven't
been able to find them.  Now, that might be my deficiency, but
it is also the case that the capabilities don't seem to be the
sort of things that are featured, in clear language, on package
labels and spec sheets.  As Paul Hoffman points out, you can't
always believe what you find in the latter, or at least can't
believe that what you think you are reading really reflects
product capabilities.

So there is, at best, a bit of a chicken-and-egg problem here:
The ISPs don't offer multiple static addresses inexpensively
because the profit (and support-minimization) incentives lie
elsewhere, partially because hardware that handles them smoothly
isn't available at a plausible price (see below).  And the
vendors don't provide the boxes at least in part because there
isn't market demand from the ISPs and users who don't have those
addresses.

Note also, for whatever it is worth, that the devices Michel,
Paul, Iljitsch, and I have been discussing are fairly high-end
as SOHO/ small-enterprise equipment goes, with retail prices in
the range of several hundreds of dollars.  The devices the ISPs
want to supply or recommend for their versions of the SOHO
market tend to be a factor of two or three (or more) less
expensive, support NAT and only NAT, and provide a much more
attractive price point, especially if one is going to bundle the
device into the monthly price of the service.

> successfully living with today.

Let's not mistake what the world will pay for, and even what it
wants, for what it is likely to get under current scenarios
(with either IPv4 or IPv6).

    john

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Thu, 6 Apr 2006 05:12:27 +0200

John Calcote writes:

> I'll just jump in here for a second and mention also that vendors
> offer what they have to, not what they can. They want to provide the
> most "bang for the buck", so to speak. These companies don't offer
> the multiple-static-ip-address option today because most ISP's don't
> offer it to home users and home (SOHO) users represent the target
> market.

It is unlikely that ISPs will ever offer static IPs or multiple IPs to
home users at any time in the future for free.  They will continue to
charge heavy premiums for such "professional" features, with or
without IPv6.

> That said, they *would* offer these features if SOHO users
> were constantly frustrated about the fact that they can't make use
> of the multiple static addresses that their ISP provides them
> because of limitations in their router equipment...

SOHO users probably won't be willing to pay 500% more for multiple or
static IPs, anyway.

> The fact is, _when_ IPv6 becomes truly mainstream and ISP's begin
> to offer multiple static addresses because they can ...

ISPs can do that already, but they charge a great deal for it, and
they probably always will.

AT&T used to charge for any telephone color other than black, even
though the cost of producing a telephone was the same no matter what
color it was.

---

From: Peter Dambier <[email-masked]>
Date: Thu, 06 Apr 2006 10:51:37 +0200

> charge heavy premiums for such "professional" features, with or

http://www.manitu.de/

They offer you:

fixed IPv4 address with reverse lookup at 9.99 Euros per month.

You must have already T-DSL to use this servevice and you will
keep that. Means the 9.99 Euros get you a second PPPoE link over
your old modem and you can have a fixed plus a dynamic IPv4 address
at one and the same time.

t-online.de offer a similar service but it is more expensive.

-- 
Peter and Karin Dambier
The Public-Root Consortium
Graeffstrasse 14
D-64646 Heppenheim
+49(6252)671-788 (Telekom)
+49(179)108-3978 (O2 Genion)
+49(6252)750-308 (VoIP: sipgate.de)
mail: [email-masked]
mail: [email-masked]
http://iason.site.voila.fr/
https://sourceforge.net/projects/iason/

---

From: "Anthony G. Atkielski" <[email-masked]>
Date: Thu, 6 Apr 2006 19:38:00 +0200

> fixed IPv4 address with reverse lookup at 9.99 Euros per month.

I don't live in Germany.  The exception does not disprove the rule.