Subject: RE: [midcom] Identifying Intra realm calls

From: "Christian Huitema" <[email-masked]>
Date: Wed, 6 Mar 2002 08:23:28 -0800

You are correct: many NATs will not "send back" the traffic. The STUN statement is wrong: when two parties are behind the same NAT, not only is the solution not very efficient; in fact, it does not always work. We should only use a solution like STUN when we know that the two stations are "far apart". Even so, there are failure modes, e.g. in the cases of dual NAT: an ISP allocate 10/8 addresses to its customers, who in turn run a NAT.

A partial solution is to use multicast discovery to find out whether the other party is local: from the UDP port that uses STUN, send a multicast packet to a conventional IPv4 multicast address and port, documenting something like "I am local and my STUN address is x.x.x.x:p"; the receiver of these packet keeps a catalog; this is what is document in version 04 of the shipworm/teredo draft. You may combine the solution with a hint, e.g. the fact that the STUN mapped addresses of the parties look alike. However, there will still be failure modes, such as the 10/8 ISP.

The only real solution to this problem is to use IPv6 and global addresses. All other solutions are hacks.

-- Christian Huitema

-----Original Message-----
From: Cedric Aoun [mailto:[email-masked]] 
Sent: Wednesday, March 06, 2002 12:16 AM
To: Midcom IETF (E-mail)
Cc: Sanjoy Sen
Subject: [midcom] Identifying Intra realm calls

Hello, 
One of the open issues that had been briefly discussed in the mailing list in the context of the pre-Midcom solutions - STUN, PHANTOM and MINT - is how to effectively route intra-realm calls (e.g. calls behind the same NAT), i.e., how does the client or a signaling server determine that the called party is in the same network realm and the media is directly routable without going through the NAT or a relay NAT (i.e. a Media Proxy). For example, the last para of Sec 9.3 in STUN draft states: It is possible that both participants in the multimedia session are behind the same NAT. In that case, both will repeat this procedure
   above, and both will obtain public address bindings. When one sends 
   media to the other, the media is routed to the nat, and then turns 
   right back around to come back into the enterprise, where it is 
   translated to the private address of the recipient. This is not 
   particularly efficient, but it does work. 
Note that, the above solution is not applicable to NATs all vendors. Given that a significant percentage of Enterprise calls are intra-realm, the issue, if resolved, will lead to considerable saving of egress bandwidth at the NAT and will lead to general improvement in service quality.
Note that this is also an issue within the MIDCOM framework. 
An ID was submitted to discuss this issue http://www.ietf.org/internet-drafts/draft-aoun-midcom-intrarealmcalls-00.txt 
The intent of this ID is to initiate some discussions (perhaps, offline) towards a solution for this issue. The intent is in no way to disrupt the progress of the WG's chartered work items, so, if you're interested to work on this problem, please send comments offline and we can move the discussions to a private mailing list ([email-masked]).
Thanks 
Cedric 
Cedric Aoun 
Nortel Networks 
France 
mailto:[email-masked] 

_______________________________________________
midcom mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/midcom

---

From: Keith Moore <[email-masked]>
Date: Wed, 06 Mar 2002 12:02:56 -0500

> A partial solution is to use multicast discovery to find out whether the 
> other party is local: from the UDP port that uses STUN, send a
> multicast packet to a conventional IPv4 multicast address and port, 
> ...

one reason this is a partial solution is that some of today's
'Ethernet switch' products don't correctly emulate Ethernet
multicast - the sending host thinks it's sending a multicast packet 
to all other hosts on the subnet but the other hosts never see it.

> The only real solution to this problem is to use IPv6 and 
> global addresses. All other solutions are hacks.

indeed.  and I wish midcom would work on things for which there
is a reasonable exit strategy to IPv6 in preference to things 
that just dig us deeper in the NAT hole. 

Keith

p.s. while not directly related to midcom, some midcomers might 
still be interested in a draft I wrote recently: Recommendations for 
the Design and Implementation of NAT-Tolerant Applications 
( draft-moore-nat-tolerance-recommendations-00 ) which looks at
possible workarounds for the NAT problem from the point-of-view 
of an applications developer that has no control over the networks 
in which his apps will be deployed.