Subject: [mobile-ip] NAT traversal addresses

From: "Michael R. Cole" <[email-masked]>
Date: Sun, 6 Jul 2003 00:28:42 -0400

Dear Pascal,

If a timesharing system has only 1 global IPv4 address (door) then the port number would serve as a 16-bit extension of the IPv4 which is essentially the same mess that a NAT box presents. You could still use 6to4 for this but the idea is to use the \80 suffix to carry information that allows the timesharing system to -easily- indentify not only the port number but possibly also the job numbers and so forth. Even if a timesharing system has a native IPv6 address and data line there still is the problem that each user needs its own IPv6 address in order to keep the port number from being used as an address extension in IPv6 - I am just suggesting a way that a timesharing system could systematically assign a unique address to each user that does not involve random number generation.

I can understand wanting to use tunneling within UDP because UDP is the simpler protocol but if a firewall only allows TCP or if the user would rather use TCP because a link is noisy (such as a wireless ISP or off of one of the Hughes satellites) or some other restriction then there needs to be a way to allow TCP.

There is also the problem that some of the cheaper NAT boxes tend to choke when somebody tries to run IPsec or HTTPS through it in which case we would need a flag that essentially says, "use some type of workaround or otherwise do what is needed to keep a low quality NAT box happy." One of the issues that I have seen discussed elsewhere is that some NAT boxes have incomplete implementation of some things that SHOULD be there. I have been told that some do not support FTP.

What I mean that going through a firewall might take some time is that the idea of a firewall is to double check everything that is happening - it may take some time to go into a database to identify somebody as legitimate and so forth which could cause a false connection not responding error.

Mike Cole, [email-masked]