Re: ISPs can easily decrease net abuse

Article View: comp.security.misc

Article #1101

Back to comp.security.misc Previous Next

#1101

From: JF Mezei
Date: Tue, 02 Dec 2003 23:04

18 lines
2222 bytes

The real problem with NAT is when applications negotiate port numbers.

For instance, FTP (in non passive mode).

Client at 10.0.0.1 behind NAT connect to server at 24.202.146.20

When client sends a GET CHOCOLATE.CAKE command, it also specifies a port
number at 10.0.0.1, and then expects 24.202.146.20 to connect to that port and
dump the contents of CHOCOLATE.CAKE

The problem is that the NAT box has no idea that 10.0.0.1 has just negotiated
the opening of some random port, and when 204.202.146.20 tries to connect, the
NAT box will tell it "sorry, I have no idea who to forward the request to
because that port number is unknown to me"

What this means is that to get stuff to work behind NAT, you need to designate
one machine as the default machine to get any unmapped ports and the software
will run only on that machine.

Technical Details

Message-ID: <3FCD1A94.25FE3630@istop.com>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!news.uunet.ca!nf3.bellglobal.com!nf1.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail

References:

<Xns944467F028317jbuserspc9org@130.179.16.24> <MPG.1a3584e54aa22f3e989eab@news-server.columbus.rr.com> <bqh37g$6nd$1@canopus.cc.umanitoba.ca> <MPG.1a3646c2d7662890989eb0@news-server.columbus.rr.com> <bqigs8$pbq$1@canopus.cc.umanitoba.ca>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 10c8f2,17f958067a510d3b
X-Google-Attributes: gid10c8f2,public
X-Google-Thread: ff723,17f958067a510d3b
X-Google-Attributes: gidff723,public
X-Google-ArrivalTime: 2003-12-02 15:17:37 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!cyclone.bc.net!news.uunet.ca!nf3.bellglobal.com!nf1.bellglobal.com!nf2.bellglobal.com!news20.bellglobal.com.POSTED!not-for-mail
Message-ID: <3FCD1A94.25FE3630@istop.com>
From: JF Mezei <jfmezei.spamnot@istop.com>
X-Mailer: Mozilla 4.76 (Macintosh; U; PPC)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.security.misc,can.internet.highspeed
Subject: Re: ISPs can easily decrease net abuse
References: <Xns944467F028317jbuserspc9org@130.179.16.24> <MPG.1a3584e54aa22f3e989eab@news-server.columbus.rr.com> <bqh37g$6nd$1@canopus.cc.umanitoba.ca> <MPG.1a3646c2d7662890989eb0@news-server.columbus.rr.com> <bqigs8$pbq$1@canopus.cc.umanitoba.ca>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Forwarded: by - (DeleGate/8.5.4)
Lines: 18
Date: Tue, 02 Dec 2003 18:04:59 -0500
NNTP-Posting-Host: 64.230.45.55
X-Complaints-To: abuse@sympatico.ca
X-Trace: news20.bellglobal.com 1070406144 64.230.45.55 (Tue, 02 Dec 2003 18:02:24 EST)
NNTP-Posting-Date: Tue, 02 Dec 2003 18:02:24 EST
Organization: Bell Sympatico

Reply to Parent Message