Subject: RE: [midcom] STUN lifetime discovery question

From: "Christian Huitema" <[email-masked]>
Date: Wed, 5 Dec 2001 22:00:16 -0800

> Am I write in assuming that the STUN lifetime discovery won't work for
> full-cone NATs when the client is sending any UDP packets (i.e. for
some
> application) through the NAT?

If you are using the same port for discovery & application, yes, there
will be pollution/

> The reason being that if the client is using a UDP application, then
those
> packets will refresh the NAT state, so the binary discovery process
won't
> discover anything.  This means that you can't really run any
applications
> until you've finished the lifetime discovery process, yes?  (Maybe
this is
> not a huge deal ... I just want to make sure my understanding is
correct.)

There is a precise discussion of this in the shipworm draft. The trick
is to use separate ports, i.e. reserve a port number solely for
discovery of life time.

> Another question.  Does anybody know if the lifetime in NAT boxes
varies?
> For instance, the NAT box could decrease the lifetime when it gets
busy?

Not observed that. It does vary from box to box.

> Or, what if the NAT box had a clever bit of software that does a hash
on
> the
> client IP address in order to try to assign the same port number even
> after
> a previous assignment has timed out?  This would result in the
lifetime
> appearing to be variable.

Sure, you can do arbitrary stuff. OTOH, most NAT are fairly simple, and
we are mostly concerned with the ones that have already shipped.

> I'm just generally wondering how much a client application can really
> depend
> on lifetime discovery . . .

It is an optimization, to reduce the amount of refresh traffic.

_______________________________________________
midcom mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/midcom

---

From: "Paul Francis" <[email-masked]>
Date: Thu, 6 Dec 2001 09:35:46 -0800

> is to use separate ports, i.e. reserve a port number solely for

Speaking of which . . . has there been any talk of somehow combining
shipworm and stun?  A minimal shipworm implementation is slightly but not
hugely more complex than stun, and shipworm might benefit from using SRV
records in addition to anycast for shipworm server discovery.

PF

---

From: "Paul Francis" <[email-masked]>
Date: Thu, 6 Dec 2001 09:41:26 -0800

> is to use separate ports, i.e. reserve a port number solely for

I guess one probably unavoidable drawback of this approach is that, if a
client is continuously doing lifetime discovery, then it is consuming twice
the number of ports in the NAT box.

> It is an optimization, to reduce the amount of refresh traffic.

I know it is an optimization, but one that can break the "connection" if it
guesses the lifetime wrong.  Given this, applications over shipworm should
either err on the side of guessing a short lifetime, or have a higher level
form of identification to survive address changes.  Since ping overhead is
an issue in wireless environments, a brief mention of this in the document
might be useful.

PF