🚀 go-pugleaf

I was helping a guy the other day and he had a DSL modem that had built in
nat/firewall and all that stuff. it was buggy though. If Rogers upgraded
their modems so it came with a built in router/firewall/nat that would be
great too (if it wasn't buggy)

"Leythos" <void@nowhere.com> wrote in message
news:MPG.1a353cd8c276f345989ea9@news-server.columbus.rr.com...
> In article <Xns944467F028317jbuserspc9org@130.179.16.24>, jem@users.pc9
> __org says...
> > As I'm sure lots of you are aware, cable/DSL machines are infected by
> > viruses and worms like nothing else. They become sources of email
viruses
> > and other types of malicious traffic.
> >
> > Then something occurred to me. Wouldn't it help dramatically if ISPs
> > delegated static IP addresses for any kind of permanent connectivity?
This
> > way, customers' addresses would stay constant and make them easier to
track
> > down:
>
> Actually, if ISP's required users to install a router with NAT it would
> eliminate most of it. The hacks and worms could not infect new machines
> protected by NAT.
>
> Most ISP's cable modem and DSL routers already have the ability to run
> NAT.....
>
> -- 
> --
> spamfree999@rrohio.com
> (Remove 999 to reply to me)

ipv6 isn't only about shortage.. it has better security and a host of
features too. For example you can't do ipsec over NAT. NAT is a hack and we
all know hacks will burn you sooner or later

"funk49" <funk49@sympatico.ca> wrote in message
news:pyRyb.4717$zf2.611681@news20.bellglobal.com...
> The need to go to ipv6 was due primarily to IP address shortages -- public
> IP address space, they don't make any more.
>
> Need to transition was put off when IGP protocols became more flexible
with
> VLSM i.e. classless vs classful plus the use of private IP address space
> i.e. 10.0.0.0/8, 172.16.0.0/16 - 172.31.0.0/16, etc. This was done some
> years ago, try and keep up !!!!!!!!!
> "Rod" <stellar@idirect.com> wrote in message
> news:5P-dnfb30tlQI1aiRVn-sA@giganews.com...
> > laurent@faked.mblelop.com (Laurent) wrote...
> > >
> > >Now that the ipv4 address shortage myth has been debunked...
> >
> > What do you mean, debunked?  Could you point me to an article, please?
> >
> > Rod
> >
>
>

In article <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com>,
booster <saltynuts2002@msn.com> wrote:
:ipv6 isn't only about shortage.. it has better security and a host of
:features too. For example you can't do ipsec over NAT. NAT is a hack and we
:all know hacks will burn you sooner or later

You *can* do IPSec over NAT.

IPSec defines multiple layers: the payload itself (possibly
encrypted), encryption headers (ESP), and authentication headers (AH).
AH is optional, and if you don't have it turned on, then you can
still use the authentication layer that ESP provides for the payload;
AH adds authentication of the IP addresses themselves.

It was not possible before to do AH over NAT, but there is now a
draft IETF "UDP Encpasulation of IPSec Packets",
http://www.ietf.org/html.charters/ipsec-charter.html
This UDP encapsulation routine -automatically- detects whether
one or both ends of the link are undergoing NAT, and does encapsulation
via UDP 4500 only if necessary.
-- 
   "There are three kinds of lies: lies, damn lies, and statistics."
   -- not Twain, perhaps Disraeli, first quoted by Leonard Courtney

In article <MPG.1a3584e54aa22f3e989eab@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
:And the intent, if you had followed the start, what the NAT with no 
:forwarding would be used. Why would I post about how it could protect if 
:the intent was to forward all ports? 

We aren't mind-readers, Leythos, to know about your *intent*.
The words you actually -wrote- had no indication in them that
you understood about issues such as port forwarding or persistant
translations.

What you wrote was,

"Actually, if ISP's required users to install a router with NAT it would 
eliminate most of it. The hacks and worms could not infect new machines 
protected by NAT."

which simply is not true. There is nothing in any official definition
of 'NAT' that talks about duration of translations or restricting
translations to be usable to only returning traffic, and seeing as
Cisco has a patent on its "Adaptive Security Algorithm", many NAT
implimentations are overly generous on leaving open port translations...
leaving windows during which hacks and worms *will* be able to infect
new machines that are active on the 'net.
-- 
   I wrote a hack in microcode,
   with a goto on each line,
   it runs as fast as Superman,
   but not quite every time!                 -- Dave Touretzky and Don Libes

Rod wrote:
> Yes I knew that the 32 bit address space was considered inadequate.

With private address spaces and good routers with NAT, A lot of businesses can
operate with just a couple of internet adresses.

Also, consider some of the huge blocks that were allocated to a few companies
early on. Digital Compaq and HP each had their huge own block of IP adresses.
HP now has all of those, even though HP today has nowhere near the same number
of employees that the individual companies had.


> dumbfounded when I read that IPv6 was 128 bits.  With 128 bits...most of
> the Earth's rocks could have an IP addresses. 

Every appliance and vehicle could have its own IP address. So when you plug
your fridge into your home LAN it would have its own public IP address, a bit
like its serial number.

Laurent wrote:
> 
> Juergen Nieveler wrote:
> > roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) wrote:
> >
> >> Not all NAT implimentations are specific about who they
> >> let back in.
> >
> > Not to mention that NAT will pass away as soon as
> > everybody is on IPv6

And NAT cannot protect against e-mail worms anyway.

> Everybody on IPv6? This will not happen in your lifetime. Now that the ipv4
> address shortage myth has been debunked, there's no point for massive
> migration towards ipv6. We'll end up with a mixed internet with both
> systems forever.
> 
> Laurent

Once the production of IP-capable cellular phones is up at full speed,
there will be more than a hundred million new phones annually. If one
NAT box can handle 10000 phones, an operator with 100 million customers
(e.g in Asia) needs ten thousand NAT boxes. A whole building full of
them...

Not surprisingly, 3GPP standardised IPv6 for the phones. In a few years
the majority of terminals connected to the Internet will run IPv6.

NAT is not a solution, it is a problem. With NAT boxes you can't have
peer-to-peer connections. Only the client-server model works. Each time
you want a direct connection, you have to use a bridging server provided
by your ISP, at a fee. And that server may become a bottleneck and a
single point of failure. The perfect target for DoS.

-- Lassi

On 1 Dec 2003 18:31:45 GMT, Walter Roberson, <roberson@ibd.nrc-cnrc.gc.ca> wrote:

>  When going out, NAT implimentations often try to use the same source
>  port number, using a different port number only if the original is in
>  use. So if you have a PC that has NETBIOS turned on, and
>  Wiley E. Windows decides to do name resolution from the netbios-ns
>  (udp 137) source port, then the NAT implimentation might, as long
>  as the translation lasts, allow -anyone- to connect to that port.
>  And this being UDP, there is mechanism to signal when the name
>  resolution conversation is finished, so the translation would be kept
>  open until some timer expires.

   I have a Netgear RT314 router, and I have it block *ALL* incoming
traffic to privileged ports, i.e. the range 0..1023.  If a user is not
running servers, indeed is forbidden by the AUP, then there is no reason
whatsoever to accept incoming traffic in that range.

   I have a couple of linux machines, not using Samba, so 135..137 isn't
an issue for me.  But I do have sshd running on both my machines, so
when I do a backup on my main machine, I can copy it to the backup
machine.  Linux also runs printers via a daemon, and I have my machines
listening for "remote" syslog output on 192.168.1.255.  Then there's X,
which is capable of listening on some ports.  Blocking privileged ports
(and X Window listening ports) at the router protects my linux machines.
For defense-in-depth, iptables limits the listening range to
192.168.1.248/29 and I launch X with the "-nolisten tcp" option.

-- 
Walter Dnes; my email address is *ALMOST* like wzaltdnes@waltdnes.org
Delete the "z" to get my real address.  If that gets blocked, follow
the instructions at the end of the 550 message.

Juergen Nieveler wrote:
> JF Mezei <jfmezei.spamnot@istop.com> wrote:
>
>> With private address spaces and good routers with NAT, A
>> lot of businesses can operate with just a couple of
>> internet adresses.
>
> Unless they want to use VoIP or something else that
> doesn't really work with NAT. NAT has already killed the
> SpeakFreely-Project...

NAT kills many, MANY things. It almost cost us instant-messaging and IRC
file-sharing. Now these can all "somewhat" work...


>> Also, consider some of the huge blocks that were
>> allocated to a few companies early on. Digital Compaq
>> and HP each had their huge own block of IP adresses. HP
>> now has all of those, even though HP today has nowhere
>> near the same number of employees that the individual
>> companies had.
>
> Just think of the huge Class-A-chunks given to the US
> Army... every rifle has it's own IP. Wait, maybe they
> already planned for Landwarrior even back then :-)

Wasn't it the other way around? Like the army gave to ARIN most of the
address space except this huge class-a chunk? (I'm not sure how the
handover from DARPA to other agencies went along the years, but since the
'Internet' was a military project at first, I'm thinking it's them that
gave us the address space they don't want)


>> Every appliance and vehicle could have its own IP
>> address. So when you plug your fridge into your home LAN
>> it would have its own public IP address, a bit like its
>> serial number.
>
> Hence the invention of UPnP. Of course, you'll need to
> install a firewall on your fridge to prevent hackers from
> breaking into it :-)

"DAMMIT! Honey we got hacked! Someone stole our mayounnaise!"

Laurent

Rod wrote:
> laurent@faked.mblelop.com (Laurent) wrote...
>>
>> Now that the ipv4 address shortage myth has been
>> debunked...
>
> What do you mean, debunked?  Could you point me to an
> article, please?

Here's some reading

http://www.ripe.net/rs/ipv4-ncc-20031030.html

http://www.potaroo.net/ispcolumn/2003-07-v4-address-lifetime/ale.html

The analysis basically says we could reach a shortage of address space
somewhere in 25 years if XYZ factors remains. Of course it all may change,
we *might* run out faster, or maybe slower.

One thing to consider is the apparent burden on the routing tables that now
must carry so many routing entries that adding up to that (right now) is
already a huge problem and has been considered to be one of the major
problems of IPv4 even before address space exhaustion. It might even be the
critical reason to force new address allotation to be in IPv6 space
instead.

Allllll speculations! No one knows how the internet will grow. One thing is
for sure, there's no shortage of ips now or anytime soon (soon = internet
years. if it's predicted that a shortage would occur in 25 years, we can
also go back 25 years ago in 1978 and see how the internet ahs grown from
there up to today...)

Sure, i'd love to ping myself at some incredibly impossible to remember
ipv6 address and have the benefit of being easier to route, but i don't
think it's gonna happen.

It might even be that we will circumvent the ipv4 problems with new
approaches to each problem, who knows.

Laurent

booster wrote:
> ipv6 isn't only about shortage.. it has better security
> and a host of features too. For example you can't do
> ipsec over NAT. NAT is a hack and we all know hacks will
> burn you sooner or later

Most, if not all, of the internet itself is a hack. Most protocols are
considered cheap hacks that would die if given the chance. Ok well, sure,
Gopher died... but still :) we've been hacking everything for decades, it
doesn't mean any of them will burn

Laurent

In article <Me0zb.5354$zf2.796466@news20.bellglobal.com>,
Laurent <laurent@faked.mblelop.com> wrote:
:NAT kills many, MANY things. It almost cost us instant-messaging and IRC
:file-sharing.

Ah, so NAT *is* a security feature after all!
-- 
   "Mathematics? I speak it like a native." -- Spike Milligan

In article <3FCC5D1A.6ADAA453@welho.compromised.invalid>,
Lassi =?iso-8859-1?Q?Hippel=E4inen?= 
	 <lassi.hippelainen@welho.compromised.invalid> wrote:
:NAT is not a solution, it is a problem. With NAT boxes you can't have
:peer-to-peer connections. Only the client-server model works. Each time
:you want a direct connection, you have to use a bridging server provided
:by your ISP, at a fee. And that server may become a bottleneck and a
:single point of failure. The perfect target for DoS.

A non-trivial problem with peer-to-peer networks is the discovery
protocol: how does one find out the address and port of another
installation without using a central registry? Once you have solved
that, then if your NAT box allows the creation of translations
that are not restricted as to who connects to them, then you
have no more problem then before.

It isn't NAT itself that is the problem for peer-to-peer: the
problem is NAT implimentations that do not permit inside systems
to create connections that are accessible by random outside hosts.
And the work-around is not using bridging server "provided by
your ISP, at a fee": the work-around is to extend the discovery
protocol to dynamically find a machine that is willing to
act as a bridging server. Not -everything- is behind blocking
NAT implimentations.
-- 
   Cottleston, Cottleston, Cottleston pie.
   A bird can't whistle and neither can I.  -- Pooh

Walter Roberson wrote:
> 
> In article <3FCC5D1A.6ADAA453@welho.compromised.invalid>,
> Lassi =?iso-8859-1?Q?Hippel=E4inen?=
>          <lassi.hippelainen@welho.compromised.invalid> wrote:
> :NAT is not a solution, it is a problem. With NAT boxes you can't have
> :peer-to-peer connections. Only the client-server model works. Each time
> :you want a direct connection, you have to use a bridging server provided
> :by your ISP, at a fee. And that server may become a bottleneck and a
> :single point of failure. The perfect target for DoS.
> 
> A non-trivial problem with peer-to-peer networks is the discovery
> protocol: how does one find out the address and port of another
> installation without using a central registry? Once you have solved
> that, then if your NAT box allows the creation of translations
> that are not restricted as to who connects to them, then you
> have no more problem then before.

The proposed solution is to use SIP (Session Initiation Protocol)
servers as meeting points. That works as long as your temporary address
persists. But how long is that?

> It isn't NAT itself that is the problem for peer-to-peer: the
> problem is NAT implimentations that do not permit inside systems
> to create connections that are accessible by random outside hosts.

Push services have problems with firewalls, and peer-to-peer needs a
push component to start the session (the equivalent of a phone ringing).
Negotiating a path through firewalls is easier, if the addresses and
port numbers remain the same end-to-end.

> And the work-around is not using bridging server "provided by
> your ISP, at a fee": the work-around is to extend the discovery
> protocol to dynamically find a machine that is willing to
> act as a bridging server. Not -everything- is behind blocking
> NAT implimentations.

But the operators want to built walled gardens. And currently they can
enforce them.

If you were running IPv6, you would have a stable global address, and
wouldn't need those bridges at all. DNS could handle the
name-IP-mapping.

-- Lassi

Walter Roberson wrote:
> In article <Me0zb.5354$zf2.796466@news20.bellglobal.com>,
> Laurent <laurent@faked.mblelop.com> wrote:
>> NAT kills many, MANY things. It almost cost us
>> instant-messaging and IRC file-sharing.
>
> Ah, so NAT *is* a security feature after all!

Security through defectiveness.

Laurent :)

In article <MPG.1a3646c2d7662890989eb0@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
|In article <bqh37g$6nd$1@canopus.cc.umanitoba.ca>, roberson@ibd.nrc-
|cnrc.gc.ca says...
|> We aren't mind-readers, Leythos, to know about your *intent*.

|Why would I post in this thread about using NAT if I wanted someone to 
|use NAT with forwarding?

I don't know, Leythos: I find your motives and logical reasonings
somewhat baffling to me, so I no longer ask myself -why- you post
what you do, and only address -what- you post.

:The intent is that if ISP's were to force NAT 
:(with no forwards) on home users that much of the worm / hacking 
:activity would be limited to web sites and email.

I do not believe that reality would match the intent you express.

|> There is nothing in any official definition
|> of 'NAT' that talks about duration of translations or restricting
|> translations to be usable to only returning traffic,

|And most NAT devices, in cable modems and in Home or SOHO units do not 
|leave any open forwards at all. In the vast majority of them they have 
|to be manually configured to open a hole in them.

|I will stand by it and say it again:
|> "Actually, if ISP's required users to install a router with NAT it would 
|> eliminate most of it. The hacks and worms could not infect new machines 
|> protected by NAT."

It appears to me that you do not understand how NAT works in practice.

When one of the inside systems wants to go out, the NAT device has to
temporarily allocate an outside address that it will map the inside
address to as it sends out the packets. In 1-to-1 NAT, when there is a
pool of private addresses to draw upon, use of a complete outside
address is allocated; in 1-to-many NAT (sometimes called PAT,
port-address-translation), use of a single port on an outside address
is allocated. Most cable modem and DSL home/SOHO users will only have
use of a single [possibly dynamic] outside address, so we will look
more closely at the PAT case.

Suppose then that inside system 192.168.0.2 wants to go out to outside
system 9.8.7.6 and that the outside interface address is 1.2.3.4.
Suppose the NAT box allocates port 33333 for this purpose, so that it
will send the packet out with source IP 1.2.3.4 and port 33333. When
the next packet was to be sent from the inside, how would the NAT box
know that it should use port 33333 again? The answer is that it creates
a temporary translation internally, that 192.168.0.2 -> 9.8.7.6 should
use port 3333. I am being deliberately vague here about the recorded
translation including the original source port and the original
destination port because not all NAT boxes handle these the same way.

So a packet goes out from 1.2.3.4 with source port 33333, hits 9.8.7.6,
and something replies; the reply packet will turn the source port
around to a destination port, so the reply will have destination
1.2.3.4 port 33333. The reply will hit the NAT device outer interface,
the NAT device will lookup port 33333 in its tables and see the
connection was initiated by 192.168.0.2, and the NAT device will do
the appropriate packet re-writing and will forward the packet on to
192.168.0.2 . Notice that there is no user-configured hole in
this procedure: the NAT device -automatically- created the hole back
to the originator, because if it didn't then normal replies would
not be able to get through.

The translation, that port 33333 reaches the original source port of
192.168.0.2, has to last at least as long as the connection lasts. If
it is a TCP connection, then the NAT device can in theory snoop on the
packets and notice a RST or do a SYN timeout, and thus figure out
(usually) when the connection ended. But if this is UDP then there is
no RST and no SYN timeout, and all that the NAT device can really do if
it wants to bother clearing out the old translation is to have a
time-since-last-traffic timeout. In other case, as long as the NAT
device has the translation on record, it will forward incoming packets
to the original source port. If that original source port was
udp 137 (because, say, the machine 192.168.0.2 is Windows machine
does DNS resolution as part of the NETBIOS process... which is the
default for some version of Windows), then that means that as
long as the translation persists, the NAT device will go ahead
and forward outside packets to 192.168.0.2's udp 137 port. Even
though no hole to do that was ever manually configured.


These packets addressed to 1.2.3.4 port 33333 that the NAT device is
forwarding over to 192.168.0.2: will the NAT device forward -any-
packet it receives (from anyone), or will it look in its tables, see
that the original destination address was 9.8.7.6, and reject packets
to 33333 that did not arrive from 9.8.7.6 ? If it only accepts packets
from the original destination and original destination port, then the
worms would indeed be much much slowed down (but there are still some
loopholes that can be exploited, so they would continue to be
-possible-.) The Cisco PIX is an example of a device that checks
the origin IP and port before passing packets on through the
translation.

But do -all- NAT devices do that kind of source/destination cross-
checking? It turns out that the lower end NAT devices do NOT do
source/destination cross-checking: for them, if any packet, from
-anywhere-, comes in addressed to port 33333 in this example, then 
as long as the translation lasts, that packet would be forwarded to 
the original source port of 192.168.0.2. That's because there are a
some exceptions where you -should- accept packets from elsewhere,
and handling those exceptions properly requires extra examination
and management layers and extra configurability, so lower end devices
often just skip that protection rather than try to deal with the
corner cases.


We are thusly in the situation where for lower-end NAT devices, if the
worm can somehow, from any machine anywhere, discover that ip 1.2.3.4
port number 33333 that leads back to 192.168.0.2 udp 137 then there is
an exploit avenue. And at first glance that would certainly look to be
orders of magnitude more difficult than just finding a single port
(137) directly on 1.2.3.4. "You would have to search 65536 times as
much space, and that would be slow enough that worms would effectively
be stopped!" It turns out, though, that in practice the port space to
be searched would not be anywhere -near- that big.

When a NAT device is choosing a port on its outside interface to use
map the original source port to, many implimentations will always
choose the -original- port number as long as it is not currently in
use. On one of those implimentations, 1.2.3.4 udp 137 is thus very
likely going to map into -some- machine's udp 137 if there is any
active port 137 translation. So worm scans for udp 137 specifically
would continue to find home/SOHO victims... perhaps not quite as
quickly as if those ports were always reachable, but sooner or later
the translate would get created and away your security goes. Other
things that NAT devices often do that reduces the search space
substantially are:

A) allocate ports sequentially (so if you know a port in use 'recently'
you can probe nearby)
B) allocate the first -available- port (so the lower port numbers
are much more likely have translations than the higher port numbers)
C) allocate from "pools".

The pools effect needs a bit of expansion. When port numbers were
being allocated, different ranges of ports were assigned different
meanings. Officially there is a high-numbered range for dynamic port
allocation, but it isn't uncommon for that range to be ignored. The
one distinction that -is- still kept is that port numbers 1 to 1023
are "privileged" ports, not to be assigned to any user process.
There are some programs (such as the rlogin daemon) that check the
source port and will refuse the connections if the source port is
not in the privileged port range. Because of this, NAT devices
that are translating an outgoing port in the privileged port range
will allocate an interface source port in the privileged port range.
This implies that if you are looking for a NAT'd translation of
outgoing port udp 137, that you are most productive searching at most
the range 1-1023, rather than the full range 1-65535. Combine this
with a routine that is smart about port allocation strategies and
about differentiating between "icmp unreachable" and
"icmp port-unreachable"...


In summary, a *good* NAT'ing firewall device does make it hard for
random machines to propogate a worm, but most consumer/SOHO devices
are NAT without firewall and do not necessarily provide very much
protection; smarter worms would get developed that would continue
to get through, sometimes with no more effort than before, sometimes
slowed but not by nearly as much as you would think at first.
-- 
   Cottleston, Cottleston, Cottleston pie.
   A bird can't whistle and neither can I.  -- Pooh

In article <Xns9445BA3CE6FDDjuergennieveler@nieveler.org>,
Juergen Nieveler  <juergen.nieveler.nospam@arcor.de> wrote:
:FTP is an evil hack as well, one that has caused more headaches to 
:firewall admins than any other protocol... 

Ah, but you are only measuring the total -number- of headaches.
If we are allowed to sum headache severities, then peered MS Exchange
Server (pre- Active Directory) must surely be a srong contender for
the title.

If you want to be strict and say that that's a product and not a
protocol, then surely by now with all the worms, netbios-ns (udp 137)
must be darn close if not in the lead.
-- 
   Come to think of it, there are already a million monkeys on a million
   typewriters, and Usenet is NOTHING like Shakespeare.  -- Blair Houghton.

In article <MPG.1a36cd3d8712184d989eb5@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
>I think that your above description of a quality router/NAT device is 
>specifically what I was suggesting. I'm not sure why anyone would want 
>to use a NAT device that didn't ensure the returned packets were from 
>the correct location.

Ouch.  Please don't rely on NAT for security.

But anyway, it's not as simple as what you're suggesting.
There's been some work done on categorizing types of NAT
behavior (see, for example, RFC 3489), and for better or
worse fully symmetric NAT will not allow some NAT
workarounds to function properly.  In the grander picture
that's probably a good thing (most NAT workarounds introduce
their own security problems), but it does mean that
symmetric NATs are harder to live with if you want to do
much beyond web browsing or other stuff that's
single-connection.  

>So, we're back to what I said before - if ISP's were to use NAT (not 
>some unsecure version of NAT) we would all be a lot better off and 
>customers would be must less at risk.

If you want a firewall, you're really much better off with a
real packet-filtering firewall that provides some means for
policy expression (rules).
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com

            Bad taste is better than no taste -- Arnold Bennett

Laurent wrote:
> > Hence the invention of UPnP. Of course, you'll need to
> > install a firewall on your fridge to prevent hackers from
> > breaking into it :-)
> 
> "DAMMIT! Honey we got hacked! Someone stole our mayounnaise!"

Nop:

"Honey, how come all of our food expired overnight ? The fridge is telling me
to throw out all the food inside because it is past their expiry date ?

However, if the fridge has a laser scanner as well, it will be able to send to
Kraft a transaction every time you take the mayonaise out, so that Kraft will
know if its customers use the mayo in the morning, afternoon, evening or for
midnight snacks.

And of course, new versions of viri will include a compromised bar code on
thatjar of mayo that triggers a latent bug in the fridge and the fridge then
sends rogue command to all other appliances in your home, potentially causing
a fire when the stove has all its heating elements on at full blast.

The real problem with NAT is when applications negotiate port numbers.

For instance, FTP (in non passive mode).

Client at 10.0.0.1 behind NAT connect to server at 24.202.146.20

When client sends a GET CHOCOLATE.CAKE command, it also specifies a port
number at 10.0.0.1, and then expects 24.202.146.20 to connect to that port and
dump the contents of CHOCOLATE.CAKE

The problem is that the NAT box has no idea that 10.0.0.1 has just negotiated
the opening of some random port, and when 204.202.146.20 tries to connect, the
NAT box will tell it "sorry, I have no idea who to forward the request to
because that port number is unknown to me"

What this means is that to get stuff to work behind NAT, you need to designate
one machine as the default machine to get any unmapped ports and the software
will run only on that machine.

On Tue, 02 Dec 2003 17:54:39 -0500, JF Mezei wrote:
> Laurent wrote:
>> > Hence the invention of UPnP. Of course, you'll need to
>> > install a firewall on your fridge to prevent hackers from
>> > breaking into it :-)
>> 
>> "DAMMIT! Honey we got hacked! Someone stole our mayounnaise!"
> 
> Nop:
> 
> "Honey, how come all of our food expired overnight ? The fridge is telling me
> to throw out all the food inside because it is past their expiry date ?
> 
> However, if the fridge has a laser scanner as well, it will be able to send to
> Kraft a transaction every time you take the mayonaise out, so that Kraft will
> know if its customers use the mayo in the morning, afternoon, evening or for
> midnight snacks.
> 
> And of course, new versions of viri will include a compromised bar code on
> thatjar of mayo that triggers a latent bug in the fridge and the fridge then
> sends rogue command to all other appliances in your home, potentially causing
> a fire when the stove has all its heating elements on at full blast.

I think I am going to have to buy stock in the anti-virus companies.

War Driving will be taking on a whole new meaning.
http://wired.com/news/autotech/0,2554,61412,00.html?tw=wn_tophead_6

In article <MPG.1a3803d0ae13b187989ebe@news-server.columbus.rr.com>,
Leythos  <void@nowhere.com> wrote:
:This is well and good, but I was really looking at this as though the 
:Cable/DSL companies would enable this option in their modems so that the 
:customer didn't have any control of the device. They could still add a 
:cheap router to share the single connection, but if the ISP, which is 
:buying a better class of a device, did this in their modems I would 
:imagine it would help the vast majority of people.

As best I can tell from what I have seen in messages flying by, most of
the cable/DSL CPE (Customer Premises Equipment) that has been installed
in North America, does not support the more secure forms of NAT. The
equipment was a -lot- more expensive when the companies decided upon
equipment years ago. The newer faster "Business Class" DSL would be more
likely to have it, I would think. Also, the higher end equipment seems to
be more common in Europe.


:Even if they were to use one of the lesser secure versions of NAT it 
:would still protect a large number of users.

For the technical reasons I went into before, it might slow down
viruses/worms, but not by nearly as much as one might hope. Who was
it that said, "The Net interprets censorship as damage, and routes
around it." ?


:This was never about the end user purchasing the device, it was about 
:the ISP's providing the functionality already built into their hardware.

Sadly, the installed equipment often doesn't have the better NAT
functionality.

Turning it on where it is present would be a start though, and
eventually old equipment will get upgraded...
-- 
'ignorandus (Latin): "deserving not to be known"'
   -- Journal of Self-Referentialism

In article <bqlfbv$7do$1@canopus.cc.umanitoba.ca>,
Walter Roberson <roberson@ibd.nrc-cnrc.gc.ca> wrote:
>the more secure forms of NAT. 

The world would be a somewhat better place if the phrase
"more secure forms of NAT" were never to appear again.

>For the technical reasons I went into before, it might slow down
>viruses/worms, but not by nearly as much as one might hope.

People who use NATs to protect themselves against viruses
and worms deserve what they get.  If you want a firewall,
run a firewall.
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com

            Bad taste is better than no taste -- Arnold Bennett

juergen.nieveler.nospam@arcor.de (Juergen Nieveler) wrote...
>
>Somebody planned way ahead, it seems - why limit the Internet just to
>our planet? 
>
>http://www.faqs.org/rfcs/rfc1606.html

Yeah, they planned for the serious future.  For the day when the sun is 
expanding, as a red giant.

But I forgot about nano-robotics.  There is bound to be kazillions of 
them in the future.  Some day.  So....  Yes, 128 bits sounds...very 
reasonable.  Technically known as a ka-ka-ka-kazillion.  It would be 
awful to be the little nano-robot that didn't have an IP 'cause they ran 
out of numbers! Like the little train that could, except....  You know?  
The others are telling it: "Phone home."  It says, "How?"  It can't get 
any orders from home base.  It just sits there, on a blood vessel or 
blood cell or something.  Doing nothing.  Looking...sad.  Little grimace 
on its tiny robotic face.  Why me?

Juergen Nieveler <juergen.nieveler.nospam@arcor.de> wrote in
news:Xns9446CDDE0630Ejuergennieveler@nieveler.org: 

> Lucas Tam <REMOVEnntp@rogers.com> wrote:
> 
>> Since IE 4.0 or 5.0, it's been pretty stable for me. So far, Mozilla
>> has crashed more often than IE (well... older beta Mozillas).
> 
> It's not the crashing I'd worry about - it's those nasty holes that 
> execute malware without even bothering to notify you...

Hmmm, never been infected... actually it hasn't bothered me.  I keep Norton 
AV updated and run Windows Update on a regular basis.

True, Windows could be MUCH better - but the alternatives are quite bleak. 
Only real choice is Mac OS X, but even OS X lacks the applications on 
Windows : (



-- 
Lucas Tam (REMOVEnntp@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

>> It's not the crashing I'd worry about - it's those nasty holes that 
>> execute malware without even bothering to notify you...
> 
> Hmmm, never been infected... actually it hasn't bothered me.  I keep
> Norton AV updated and run Windows Update on a regular basis.

Actually, Windows is not that bad when you use it properly. Don't use the 
admin account unless you need to; do your day-to-day activities as a user 
with regular privileges. And don't use IE or Outlook. If you do these 
things your Windows system will run beautifully.

It's amazing how a Windows install goes to hell if you muck around in the 
admin account. We have several Windows 2000 installs for students to use. 
Half of them are strictly maintained, but a couple have known admin 
passwords to allow some 'trusted' students to install their own software.

What a disaster :) Spyware, Yahoo toolbars and all kinds of crap on the 
system where students use the admin account. Remember that spyware or 
whatever with admin privileges gets to all users' accounts...

-- 
Jem Berkes
http://www.sysdesign.ca/

Lucas Tam wrote:
> Hmmm, never been infected... actually it hasn't bothered
> me.  I keep Norton AV updated and run Windows Update on a
> regular basis.

Funny story. I've lost a substantial worth of workhours because of a
virus/trojan that either I, or someone on our lan got. The funny part is
that I *have* an up-to-date Norton antivirus, and an up-to-date AVG
antivirus as well (testing both). I also tried McAfee's up-to-date free
webscan. None of them detected the trojan. Only I was able to detect it,
the obvious randomly named .exes everywhere in the registry's
Run/Runservices, it's a dead giveaway.

Anyway I sent samples to Norton for analysis, they responded with "this is
trojan blahblah, please download our beta definitions". The beta
definitions indeed got me cleaned.

Guess what? A week later, all of the available antivirus still sees *NADA*
on this trojan. (I kept it in a zip file for tests).

So really, antivirus software are crap when you're not a high-paying
corporate user. SUuuuuure the corporate editions of all these products must
detect this trojan. But not the consumers versions yet. Maybe in a week? If
it were a bigtime virus like say, "Melissa", all mediated and all, it'd be
detected within minutes. But a lowprofile trojan that doesn't destroy
files? I'm left helpless.

Frankly, i've lost respect for antivirus companies.

Laurent

Rod sez:
> juergen.nieveler.nospam@arcor.de (Juergen Nieveler) wrote...
>>
>>Somebody planned way ahead, it seems - why limit the Internet just to
>>our planet? 
>>
>>http://www.faqs.org/rfcs/rfc1606.html
> 
> Yeah, they planned for the serious future.  For the day when the sun is 
> expanding, as a red giant.
> 
> But I forgot about nano-robotics.  There is bound to be kazillions of 
> them in the future.  Some day.  So....  Yes, 128 bits sounds...very 
> reasonable.  Technically known as a ka-ka-ka-kazillion.  It would be 
> awful to be the little nano-robot that didn't have an IP 'cause they ran 
> out of numbers! Like the little train that could, except....  You know?  
> The others are telling it: "Phone home."  It says, "How?"  It can't get 
> any orders from home base.  It just sits there, on a blood vessel or 
> blood cell or something.  Doing nothing.  Looking...sad.  Little grimace 
> on its tiny robotic face.  Why me?
> 

Hmmm... Femto-virus? Pico-trojan? And is it Nano-Distributed-Denial-
Of-Service or Distributed-Denial-Of-Nano-Service? Or would those be two
different things? Curioser and curioser...

Dima
-- 
I'm going to exit now since you don't want me to replace the printcap. If you
change your mind later, run                        -- magicfilter config script

Laurent wrote:
> virus/trojan that either I, or someone on our lan got. The funny part is
> that I *have* an up-to-date Norton antivirus, and an up-to-date AVG
> antivirus as well (testing both). 

Pardon the lack of diplomacy here, but I kind of laugh at people who need
virus checking software. 

If your applications are so vulnerable to viri that you need to spend mega
time keeping some anti-virus software uptodate to ensure it protects you, why
do people continue to use those applications that are so vulnerable to viri ?

Software is suppoosed to work FOR you. Not the other way around.

Leythos wrote:
> would not find them - they are many tools available, but nothing
> competes with MS Word, Excel or Visio for integration and ease of use.

Just a reminder that Microsoft Office exists for the MAC. But none of those
widnows executables run on a mac. 

> I can honestly say that not one computer under our control has ever been
> infected by any form of virus/worm, and the networks we've designed have
> never been compromised 


Can you say that the tens of thousands of Microsoft infested computers around
the world haven't even attempted to send you viri, taken up large amounts of
bandwidth ?

Sorry, but i don't run anything microsoft and thsoe microsoft viri affect me
because they fill up logs, slow down email because of filtering that is needed
to catch stuff like SWEN which continues to flow freely.

JF Mezei wrote:
> Laurent wrote:
>> virus/trojan that either I, or someone on our lan got.
>> The funny part is that I *have* an up-to-date Norton
>> antivirus, and an up-to-date AVG antivirus as well
>> (testing both).
>
> Pardon the lack of diplomacy here, but I kind of laugh at
> people who need virus checking software.

I also lack at people who need firewalls. I mean, if all your software is
vulnerable, why connect to the internet in the first place? there's no
point for firewalls or virus checking software.

Face it, Mr Mezei, things are not always the way you would prefer. Of
course i'd be a happy camper doing my programming work on a linux box and
my graphic design on a Mac, but it's not going to happen. In the company I
work for, the platform is windows. So i got the best of them, windows 2000.
I armed myself with antivirus software. I keep everything freaking patched
up to the elbows, including office which most people tend to forget.

Yeah sure I could write my emails in notepad and send them through
sendmail.exe or something, but you see, I need some sort of groupware
thingy that actually works with my collegues and clients and suppliers, so
I got myself Office. Sure I would write my papers in Abiword and work up my
numbers in Gnumeric in a shell from my home X server, but why would I?

The point is, I need an anti-virus because i need to use software that
needs anti-virus.

> If your applications are so vulnerable to viri that you
> need to spend mega time keeping some anti-virus software
> uptodate to ensure it protects you, why do people
> continue to use those applications that are so vulnerable
> to viri ?

No, they are not. But you see, i am a good computer user. I am on top of
things. My network was never brought down by anything else than power
failures, my computers were never brought down for anything else than
maintenance. I am a good admin and I do my job right. Therefore, I put
anti-virus software and firewalls and other preventive measures to ensure
that the chances are reduced to an acceptable minimum.

> Software is suppoosed to work FOR you. Not the other way
> around.

Well then, why don't you write some software? Maybe you could make this
world a better place if you could come up with a replacement for Office
that works great and that the regular receptionnist can figure out how to
work with without calling the IT department every 12 minutes. For now
though, nobody came up with that. Well there's always Lotus Notes but
that's another discussion thread altogether.

Laurent

Laurent wrote:
> I also lack at people who need firewalls.

um... just to make it clear, i meant to type "i also laught at" :)

Laurent

Leythos <void@nowhere.com> wrote:
> In article <3FD0274D.D7EB8D84@istop.com>, jfmezei.spamnot@istop.com 
> says...
>> Leythos wrote:
>> > would not find them - they are many tools available, but nothing
>> > competes with MS Word, Excel or Visio for integration and ease of use.
>> 
>> Just a reminder that Microsoft Office exists for the MAC. But none of those
>> widnows executables run on a mac. 
>> 
>> > I can honestly say that not one computer under our control has ever been
>> > infected by any form of virus/worm, and the networks we've designed have
>> > never been compromised 
>> 
>> Can you say that the tens of thousands of Microsoft infested computers around
>> the world haven't even attempted to send you viri, taken up large amounts of
>> bandwidth ?

> I can honestly say that if there was no more MS on Saturday that the 
> next target would be the thousands of unprotected Linux installs around 
> the world that would then turn into zillions of unprotected installs as 
> MS users move over to Linux. 

> There are several new hacks for MAC OS X out - the latest is the DHCP 
> one.

>> Sorry, but i don't run anything microsoft and thsoe microsoft viri affect me
>> because they fill up logs, slow down email because of filtering that is needed
>> to catch stuff like SWEN which continues to flow freely.

> I agree, the MS target is a large one and is takes tons of bandwidth, 
> but if MS was to go away the attacks would not - they would be 
> redirected at the next OS and be just as much a problem.

> What you need to do it focus your anger on two areas - the people that 
> provide the hacks and the ISP's that provide the open connection to 
> people that have no clue and are not provided with any warning. If you 
> would address your issues to those people we might be able to do 
> something constructive.

> Telling people to not use MS products is like telling people to not 
> drive SUV's - I love my 4x4 Quad Cab V8 truck and my BMW Z3, I'm not 
> going to switch down to a VW just to please the eco nuts.

The usage of MS products AND SUV's are  waistful, dangerous and
a treath to mankind. Not to say it's a very bad price/performance
to the task to be done.


Next question...


> -- 
> --
> spamfree999@rrohio.com
> (Remove 999 to reply to me)

-- 
Peter H�kanson         
        IPSec  Sverige      ( At Gothenburg Riverside )
           Sorry about my e-mail address, but i'm trying to keep spam out,
	   remove "icke-reklam" if you feel for mailing me. Thanx.

JF Mezei <jfmezei.spamnot@istop.com> wrote in
news:3FCFF6F4.7DB4E310@istop.com: 

> Laurent wrote:
>> virus/trojan that either I, or someone on our lan got. The funny part
>> is that I *have* an up-to-date Norton antivirus, and an up-to-date
>> AVG antivirus as well (testing both). 
> 
> Pardon the lack of diplomacy here, but I kind of laugh at people who
> need virus checking software. 

Every so often... I bump into a virus.

You should always practice safe computing... because you never know!


> If your applications are so vulnerable to viri that you need to spend
> mega time keeping some anti-virus software uptodate to ensure it
> protects you, why do people continue to use those applications that
> are so vulnerable to viri ? 


Actually my AV auto-updates. I don't even notice  : )

-- 
Lucas Tam (REMOVEnntp@rogers.com)
Please delete "REMOVE" from the e-mail address when replying.
http://members.ebay.com/aboutme/coolspot18/

Leythos <void@nowhere.com> wrote:
> In article <bqqc7k$mm0$4@nyheter.ipsec.se>, phn@icke-reklam.ipsec.nu 
> says...
>> Leythos <void@nowhere.com> wrote:
>> > Telling people to not use MS products is like telling people to not 
>> > drive SUV's - I love my 4x4 Quad Cab V8 truck and my BMW Z3, I'm not 
>> > going to switch down to a VW just to please the eco nuts.
>> 
>> The usage of MS products AND SUV's are  waistful, dangerous and
>> a treath to mankind. Not to say it's a very bad price/performance
>> to the task to be done.

> So, you are suggesting that people use less efficient applications and 
> get less work done to avoid what?

No, i'm saying that people uses less efficient applications and
OS , producing less useful work.

Same goes with SUV's. Uses more gas and has less passenger and luggage
space.

But i assume that yur preferences for both of the above
is done with emotional reasons rather then facts and figures
about their respective performance.

> You can't name one Product that competes with MS Office XP for power and 
> performance! 


You mention two different things, a word-mungler and an 
Operating System. Yes, i can imagen a more efficient OS then XP.In
fact it's difficult not to :-)

And " MS Office" is a family, word-mungler, OH-cartoons and a 
spreadsheet.  

Depends on work that should be done. For sending e-mail 'pine' is one.
Spreadsheets are done with a number of alternatives, gnumeric is 
one of them.



> -- 
> --
> spamfree999@rrohio.com
> (Remove 999 to reply to me)

-- 
Peter H�kanson         
        IPSec  Sverige      ( At Gothenburg Riverside )
           Sorry about my e-mail address, but i'm trying to keep spam out,
	   remove "icke-reklam" if you feel for mailing me. Thanx.

phn@icke-reklam.ipsec.nu wrote:
>> You can't name one Product that competes with MS Office
>> XP for power and performance!
>
>
> You mention two different things, a word-mungler and an
> Operating System. Yes, i can imagen a more efficient OS
> then XP.In fact it's difficult not to :-)

no, "Microsoft Office XP" is the actual name of a suite of sofware, not an
operating system. It does, however, share the same two-letters as its
version numering as "Microsoft Windows XP", the operating system.

> And " MS Office" is a family, word-mungler, OH-cartoons
> and a spreadsheet.
>
> Depends on work that should be done. For sending e-mail
> 'pine' is one.

The ability of one person to send and receive email with pine proves
absolutely nothing about the performance and usability of another software.
Outlook is one powerful program which has little competition. Sure you can
email with Pine, i can do it with Eudora as well. But when it comes to
office-type integration of work, files, calendar-workgroup thingies,
nothing comes close. The open-source community has been imitating the work
for years trying to come up with a better solution. I can't wait to get
myself one, but in the meantime, openoffice isn't cutting it. Evolution is
pretty, but nowhere near outlook's features.

> Spreadsheets are done with a number of alternatives, gnumeric is
> one of them.

Yeah. Send gnumeric to a professional accountant doing real work. Your
computer is going to get back to you airborne. Excel is unmatched. Yes
there are some bugs/exploits and yes it cost a freaking lot of money. So
does Autocad.

Now we could argue that most people don't need Excel, and i would agree.
But you can't just wildly compare some opensource application with its
general microsoft equivalent and pretend that one can replace the other's
work.

Sure, microsoft's product have a lot of problems, security holes and
whatnot. Yes they're also bloaty. But you can't just pretend to replace all
that and achieve the same results.

Laurent

In article <MPG.1a353cd8c276f345989ea9@news-server.columbus.rr.com>,
 Leythos <void@nowhere.com> wrote:

> Actually, if ISP's required users to install a router with NAT it would 
> eliminate most of it. The hacks and worms could not infect new machines 
> protected by NAT.

Malware can spread via reading email or web pages.  NAT is totally 
ineffective at stopping that.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <Xns9444C41F512FBjbuserspc9org@130.179.16.24>,
 Jem Berkes <jem@users.pc9__org> wrote:

> Ideally this would happen. However as we know, the great majority of ISPs 
> are useless in dealing with abuse. And _that's_ why I'm saying static IPs 
> all around would be nice, because then the Internet community could more 
> easily spot the point source of abuse and take their own measures to block  
> it -- blacklist the IP address so people can block mail and any other 
> traffic at their own firewalls/routers.
> 
> So the benefit of static addressing would be to the Internet in general, 
> not to individual ISPs.

By this logic, ordinary citizens should be allowed to perform activities 
that are normally restricted to law enforcement organizations (e.g. 
phone taps), because the police can't investigate all crimes.

We should be holding ISPs to a higher standard, not giving up and 
becoming Internet vigilantes.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <3FCC2E21.12D33B2@istop.com>,
 JF Mezei <jfmezei.spamnot@istop.com> wrote:

> Every appliance and vehicle could have its own IP address. So when you plug
> your fridge into your home LAN it would have its own public IP address, a bit
> like its serial number.

But does every lightbulb really *need* a unique address?

If I wanted to control my home appliances from the Internet, I think it 
would make much more sense to connect to a home-control server (which 
would either have a public IP or (more likely) use port-forwarding on 
the NAT router).  This server would then control all the devices in the 
home, communicating with them via private addresses?

The thing is, even if we didn't have NAT, that's probably the best way 
to design the system.  NAT-or-NOT, you'll still want to have a firewall 
at the periphery of your home network, and it would be a maintenance 
nightmare opening addresses for each appliance you want to be able to 
control remotely.  And each appliance would have to have its own 
authentication mechanism.  If security is to be effective, it has to be 
easy to manage (and since we're talking about home users, not computer 
professionals, this means *really* easy), so keeping things simple is 
critical.  Having just one machine to allow access to and configure 
logins on fits the bill.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

Leythos wrote:
> Actually my 4x4 Quad cab holds just as many people as a large car. and
> get's the places that the Car could never get them. Same for MS Office,
> does everything the freeware apps do, but sooooo much more.

Yep, both are bloated. And in 99% of the time, 90% of their features are not
needed. Most SUV owners are urbanites whose vehicle is used to by soccer moms
to go to the shops. How often do you see an SUV with more that one occupant ?

98% of Word documents are simple business letters that could have been written
with a character cell word processor. Very very very ver few people (except
virus writers) use scripting for Word.

And if Microsoft had done its job right, people wouldn't be composing simple
emails with Word, and/or Word would convert messages to simple text before
sending them on the internet, unless the user has specifically attached the
word document as a binary attachement.

If Microsoft had done its job right, people wouldn't be sending HTML emails
and Microsoft mail clients wouldn't try to process HTML emails, they would see
them as binary attachements and offer to save them or perhaps launch the web
broser to view the contents.

In article 
<0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com>,
 "booster" <saltynuts2002@msn.com> wrote:

> ipv6 isn't only about shortage.. it has better security and a host of
> features too.

True, but none of them is a "killer app" that would cause a mass 
conversion.  The main impetus was the address space shortage, and they 
took advantage of the opportunity to address some other limitations of 
IPv4.

But since the address space problem has been abated, I don't see any 
rush to switch.  When I was working for Genuity I don't think anyone was 
giving any thought to implementing v6 on our backbone, and when Level(3) 
took over there was still none that I heard of.  I expect similar 
attitudes at most ISPs.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <4N0Ab.13923$yd.2053593@news20.bellglobal.com>,
 "Laurent" <laurent@faked.mblelop.com> wrote:

> The point is, I need an anti-virus because i need to use software that
> needs anti-virus.

Well said.

I've heard that most colds are spread around communities through 
children interacting at school.  So the obvious cure for the common cold 
is to stop having children. :)

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <3FCC5D1A.6ADAA453@welho.compromised.invalid>,
 Lassi Hippelainen <lassi.hippelainen@welho.compromised.invalid> wrote:

> Once the production of IP-capable cellular phones is up at full speed,
> there will be more than a hundred million new phones annually. If one
> NAT box can handle 10000 phones, an operator with 100 million customers
> (e.g in Asia) needs ten thousand NAT boxes. A whole building full of
> them...

My guess is they'll need all those routers whether or not they do NAT.  
How many downstream devices do you think a non-NAT router can handle?

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <bqh37g$6nd$1@canopus.cc.umanitoba.ca>,
 roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) wrote:

> In article <MPG.1a3584e54aa22f3e989eab@news-server.columbus.rr.com>,
> Leythos  <void@nowhere.com> wrote:
> :And the intent, if you had followed the start, what the NAT with no 
> :forwarding would be used. Why would I post about how it could protect if 
> :the intent was to forward all ports? 
> 
> We aren't mind-readers, Leythos, to know about your *intent*.
> The words you actually -wrote- had no indication in them that
> you understood about issues such as port forwarding or persistant

You don't need to be a mind-reader, just read his words in *context*.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

In article <Xns944A791483E35juergennieveler@nieveler.org>,
 Juergen Nieveler <juergen.nieveler.nospam@arcor.de> wrote:

> Barry Margolin <barmar@alum.mit.edu> wrote:
> 
> > My guess is they'll need all those routers whether or not they do NAT.  
> > How many downstream devices do you think a non-NAT router can handle?
> 
> Millions? Billions? With non-NAT routers, there's some huge machines 
> out there that take care of the major internet backbones...

I thought you were talking about devices that are immediately downstream 
of a particular router, not potentially many hops away.  E.g. a router 
with thousands of devices on its LAN interface.

> For a non-NAT-router, bandwidth and routing tables are the only issues. 
> For a NAT-router, you need far more memory because it also has to take 
> care of connection states and NAT tables...

I think you brought this up in the context of IP to cellphones.  I think 
the routers will need to keep track of considerable wireless state to 
implement this, and that may limit the number of cellphones that a 
particular router can handle.

-- 
Barry Margolin, barmar@alum.mit.edu
Woburn, MA

Barry Margolin wrote:
> 
> In article <Xns944A791483E35juergennieveler@nieveler.org>,
>  Juergen Nieveler <juergen.nieveler.nospam@arcor.de> wrote:
> 
> > Barry Margolin <barmar@alum.mit.edu> wrote:
> >
> > > My guess is they'll need all those routers whether or not they do NAT.
> > > How many downstream devices do you think a non-NAT router can handle?
> >
> > Millions? Billions? With non-NAT routers, there's some huge machines
> > out there that take care of the major internet backbones...
> 
> I thought you were talking about devices that are immediately downstream
> of a particular router, not potentially many hops away.  E.g. a router
> with thousands of devices on its LAN interface.

In GSM/GPRS cellular networks, and with existing equipment, there may be
more than 100'000 phones that are only one IP hop from the access router
(a.k.a. the GGSN). Future 3G nets support over a million. There are
several L2 hops, though...

> > For a non-NAT-router, bandwidth and routing tables are the only issues.
> > For a NAT-router, you need far more memory because it also has to take
> > care of connection states and NAT tables...
> 
> I think you brought this up in the context of IP to cellphones.  I think
> the routers will need to keep track of considerable wireless state to
> implement this, and that may limit the number of cellphones that a
> particular router can handle.

Correct. There's also the firewall part. There may be a kilobyte of data
per session, plus buffers. The access router needs lots of RAM.

An important issue is peer-to-peer services between mobiles. If you
think it is easy, see what the IETF/nsis workgroup has been writing
about enabling services through NAT/FW boxes:
http://www.ietf.org/internet-drafts/draft-ietf-nsis-nslp-natfw-00.txt
(only 147kB). With IPv6, you can avoid most of that hassle.

-- Lassi

Tony Reed wrote:
> In article
>  <barmar-595B0A.17571505122003@netnews.attbi.com>, Barry
> Margolin <barmar@alum.mit.edu> wrote:
>
>> I've heard that most colds are spread around communities
>> through children interacting at school.  So the obvious
>> cure for the common cold is to stop having children. :)
>
> Or stop sending them to school.

And wash their toys in chlorine bleach every day. What about living in a
bubble? Bubbleboy! </obvious Seinfeld reference>

Laurent

"Laurent" <laurent@faked.mblelop.com> writes:

>Tony Reed wrote:
>> In article
>>  <barmar-595B0A.17571505122003@netnews.attbi.com>, Barry
>> Margolin <barmar@alum.mit.edu> wrote:
>>
>>> I've heard that most colds are spread around communities
>>> through children interacting at school.  So the obvious
>>> cure for the common cold is to stop having children. :)
>>
>> Or stop sending them to school.

>And wash their toys in chlorine bleach every day. What about living in a

Good move... dioxins lead to genetic defects.

>bubble? Bubbleboy! </obvious Seinfeld reference>

>Laurent


-- 
/"\ Bernd Felsche - Innovative Reckoning, Perth, Western Australia
\ /  ASCII ribbon campaign | I'm a .signature virus!
 X   against HTML mail     | Copy me into your ~/.signature
/ \  and postings          | to help me spread!

Juergen Nieveler wrote:
> 
> Lassi Hippel�inen <lahippel@ieee.orgasm-research.invalid> wrote:
> 
> > Correct. There's also the firewall part. There may be a kilobyte of
> > data per session, plus buffers. The access router needs lots of RAM.
> 
> Now what will mobile phone services need a firewall for? ;-)

The mobiles can be programmed to have no buffer overflows, metacharacter
misencodings, or other errors of that kind. It only takes a sufficient
amount whipping of the slaves in the code factory.

But even when unsolicited packets are perfectly harmless, the damn users
don't want to pay for receiving them.

-- Lassi

Lassi Hippel�inen wrote:
> The mobiles can be programmed to have no buffer overflows, metacharacter
> misencodings, or other errors of that kind. It only takes a sufficient
> amount whipping of the slaves in the code factory.

You are forgetting Wintel laptops and Windows CE PDAs that connect to a mobile
network via GPRS.

They will be vulnerable to all the same windows and wince
viri/trojans/emails/scripts/word documents.

In article <Xns944D5CB03B028juergennieveler@nieveler.org>,
Juergen Nieveler  <juergen.nieveler.nospam@arcor.de> wrote:
>Now what will mobile phone services need a firewall for? ;-)

Aside from the obvious issues, it's possible to mount a DoS
attack on a mobile phone that will run its batteries down -
just send it a steady stream of packets.
-- 
     Melinda Shore - Software longa, hardware brevis - shore@panix.com

         While George Bush has been president, American jobs have 
                disappeared at the rate of 2 per minute