Subject: Re: My thoughts on local-use addresses

From: "J. Noel Chiappa" <[email-masked]>
Date: Thu, 1 May 2003 11:25:24 -0400

> From: james woodyatt <[email-masked]>

    > I can assure you that the vast majority of those customers using the u
    > NAT in either of these products-- and I get a lot of customer feedback
    > .. -- are doing so for reasons that are far less technical than you
    > suggest.
    > They are *not* doing it because they "want identifiers for their
    > machines that are independent of their location in the connectivity
    > topology." They are doing it because they want to share their Internet
    > access with multiple computers.

Your take is not matched by what other people are saying, which is what I was
going on (but see below).

E.g. one person recently replied to a private message of mine (he can speak
for himself, if he wants), but the substance of what he said was that he
think that outside the US, almost everyone uses a NAT (not just homeowners
who want to hook up N computers when their always-on-ISP only gave them one
address), and he implied that addressing was a big issue (the example he gave
was of a university that didn't want to renumber again, after switching ISP's
once).

However, as the old aphorism goes, "the plural of anecdote is not data" - and
the situation may also have the usual statistics ("lies, damn lies, <etc>)
issues.

It may well be, for example, that the majority of NAT *boxes* sold go into
house applications where the intent is to share one address, but that a
relatively few very large NAT boxes (e.g. at companies) account for a larger
number of *users*.

I'd love to hear of some real data to sort this all out.

    > Have any of you looked at the actual marketing copy that sells real
    > people on why they might want to pay real money for a NAT box? It might
    > be instructive.

You really expect the marketing department to have clue? :-)

	Noel

---

From: Richard Welty <[email-masked]>
Date: Thu, 1 May 2003 16:34:46 -0400 (EDT)

> You really expect the marketing department to have clue? :-)

no one expects the marketing department to have even been in the same
room as a clue.

but you're misunderstanding his point. the consumers buying the product
read the box and a significant percentage of them are foolish enough to
believe what the box tells them. one of the big selling points in the
on-box marketing gibberish are foolish claims that NAT is a security
device, and some devices actually claim to be firewalls even though the
only thing that passes for security in them is the port NAT.

richard
--
Richard Welty                                         [email-masked]
Averill Park Networking                                         518-573-7592
              Unix, Linux, IP Network Engineering, Security

---

From: Peter Deutsch <[email-masked]>
Date: Thu, 01 May 2003 14:29:33 -0700

g'day,

>     > From: james woodyatt <[email-masked]>
...
> going on (but see below).
...
> I'd love to hear of some real data to sort this all out.

I'm with you, although there does seem to be a school of thought here
that says that because its violates the end-to-end principle, it doesn't
matter how many people are doing it. In other words "it's wrong, even if
the duck enjoys it..."

Which leads me to my latest heretical thought - given the amount of
energy being expended to unsuccessfully figure out how to make the
end-to-end axiom coexist with today's Internet, how bad would it be to
spend some time reexamining that particular axiom? Suppose rather than
listing the apps that break when addresses are NATed, and using this
list as a reason to not change things, we use that list as a starting
point to examine ways to fix them?  Everyone seems to think the problem
is not intractible, but we can't get there from here because we seem to
have a built-in conflict with our starting assumptions. So, for example,
rather than take "end-to-end" to mean "host-to-host", what happens if we
postulate it to mean "first router to last router"? What if we
postulated a hierarchy of identifiers across a network?

As you pointed out earlier, folks talked about separating out the end
point identifier in the past, maybe we should reexamine this suggesion
in light of today's impasse? Maybe what we really need here is to change
one of the axioms and see if it takes us to a non-Euclidian geometric
space?

Nah, let's just continue trying to square the circle....

This whole debate is starting to remind me of the Quebec comedian who
parodied that province's separatists as wanting "an independent Quebec
within a strong and united Canada". Personally, I wont rest until I have
ephemeral, easily changed end point identifiers that are stable and
permanent!

				- peterd

-- 

---------------------------------------------------------------------
    Peter Deutsch                       [email-masked]
    Gydig Software

  "It is inhumane, in my opinion, to force people who have a
   genuine medical need for coffee to wait in line behind people
   who apparently view it as some kind of recreational activity."

                                        -- Dave Barry

---------------------------------------------------------------------

---

From: james woodyatt <[email-masked]>
Date: Thu, 1 May 2003 22:42:24 -0700

On Thursday, May 1, 2003, at 08:25 US/Pacific, J. Noel Chiappa wrote:
> [I wrote:]

Actually, I expect the people reading the marketing copy to have at 
least enough clue to be able to decide whether the price in 
dollars/euros/yuan/Imperial-credits charged by the vendor is acceptable 
to them.

My point is that people pay real money to buy NAT devices.  Some of 
them buy retail consumer electronics appliances.  Others buy enterprise 
grade networking gear.  Still others buy licenses to software and 
integrate it into other products.  The market is large enough that it 
should *not* be hard to get a fix on why people buy them without paying 
Gallup to conduct a scientific poll.

There are many reasons people buy NAT devices.  I'm sure there are even 
some people who like having them primarily because they "want 
identifiers for their machines that are independent of their location 
in the connectivity topology," but frankly-- I think those people are 
very weird, and I doubt that very many of them are spending their own 
money to purchase their NAT devices.

-- 
j h woodyatt <[email-masked]>
markets are only free to the people who own them.

---

From: james woodyatt <[email-masked]>
Date: Thu, 1 May 2003 23:32:05 -0700

On Thursday, May 1, 2003, at 14:29 US/Pacific, Peter Deutsch wrote:
>
> [...] As you pointed out earlier, folks talked about separating out 
> the end

I am reminded of a pleasant discussion I had on Wednesday with one of 
my colleagues, who studied under David Cheriton at Stanford.  He 
recommended Dr. Cheriton's TRIAD paper to me, which takes pretty much 
exactly the approach you suggest above, so I dutifully scurried off and 
read it.

TRIAD is a wonderful idea.  I love it.  I'm almost sold.  Almost.  
Unfortunately, while I see how the approach can be made to work without 
a mass rollout of new functionality in the routers, or even in the 
hosts, it *does* require a new infrastructure of relay agents.  In 
other words, his fix for NAT doesn't work, because the existing NAT 
deployments interfere with it.  Doh!

So I sat down with a hot cup of coffee in the atrium and sketched up an 
idea of what it would take in the hosts (and in strategically 
positioned middleboxes in the network) to work around the problem posed 
by existing NAT deployments, so that we could phase them out and get 
back the all-singing, all-dancing end-to-end goodness that is supposed 
to have existed in the ancient Internet world.

I've read RFC 3424, and I'm pretty familiar with the technical issues 
it describes, as well as the various solutions that have been tried.  
Ultimately, I ended up reinventing Christian Huitema's Teredo proposal, 
only-- the thing I was thinking about tunneling over UDP/IPv4 to solve 
the RFC 3424 problems wasn't IPv6, it was a horrible abomination cooked 
up to try to avoid deploying IPv6.  Again: doh!

For a brief moment, I thought it might be helpful to make the following 
suggestion: maybe the problem with Teredo is that the *only* thing you 
can do with it is extend IPv6 service over IPv4 through reasonably 
well-behaved NAT implementations.  What if we were to specify a 
"generic Teredo" that concentrated solely on solving the RFC 3424 
problem in a generic way and let the market decide on a profile of the 
"generic Teredo" service that it likes?

And then I sobered up and realized that an idea that seemed so 
eminently sensible to me would likely be regarded by the IAB as only 
slightly less welcome than a cholera outbreak.

> Nah, let's just continue trying to square the circle....

A fine idea.  I have my square right here.

-- 
j h woodyatt <[email-masked]>
that's my village calling... no doubt, they want their idiot back.