Subject: RE: FW: INIT from private IP address to public IP address never received

From: "Eng Se-Hsieng" <[email-masked]>
Date: Sat, 3 May 2003 10:16:44 +0800

Hi Brian,

I'm trying to initiate an association from a real GPRS network,
presumably behind a NAT box. 

Host A is on a GPRS network (private IP 172.18.56.36) and Host B is on a
university network (fixed public IP 137.132.165.146)

Host A can ping and ftp Host B. Using the ref implementation, the INIT
chunk is formulated and sent from Host A but never arrives at Host B.
Below is the tcpdump output from the operator side. 

14:30:39.826588 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:30:39.947056 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:30:45.826561 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:30:57.126663 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:31:21.266795 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:32:12.178799 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
14:33:04.639663 I 172.22.83.100.32770 > 137.132.123.4.53:  53768+ A?
CYRILLE.nus.edu.sg. (36) (DF) 
14:33:04.659178 O 137.132.123.4.53 > 172.22.83.100.32770:  53768
NXDomain* 0/1/0 (83) 
14:33:05.719556 I 172.22.83.100.32770 > 137.132.123.4.53:  53769+ A?
CYRILLE. (25) (DF) 
14:33:05.724976 O 137.132.123.4.53 > 172.22.83.100.32770:  53769 Refused
0/0/0 (25) 
14:33:06.399734 I 172.22.83.100.32770 > 137.132.5.2.53:  53769+ A?
CYRILLE. (25) (DF) 
14:33:06.405689 O 137.132.5.2.53 > 172.22.83.100.32770:  53769 Refused
0/0/0 (25) 
14:33:07.279830 I 172.22.83.100.32770 > 137.132.123.4.53:  53769+ A?
CYRILLE. (25) (DF) 
14:33:07.285648 O 137.132.123.4.53 > 172.22.83.100.32770:  53769 Refused
0/0/0 (25) 
14:33:07.999634 I 172.22.83.100.32770 > 137.132.5.2.53:  53769+ A?
CYRILLE. (25) (DF) 
14:33:08.859617 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48

Granted that the NAT or firewall probably does not support SCTP , two
surprising things occur in this tcpdump.

1. DNS queries of the source machine hostname (CYRILLE) with variations
CYRILLE.nus.edu.sg and CYRILLE
 
2. for every SCTP packet sent, we noticed one corresponding ICMP packet
on Ethereal, from the operator's network, with the Destination
Unreachable (3) code and Host Unreachable subcode (1). Surprisingly, the
Protocol Unreachable subcode wasn't received.
 
Would anyone happen to have any ideas on what these ICMP packets are 
for or why the DNS queries are carried out? Path MTU discovery?
 
Also, what are the chances of us implementing UDP encapsulation
successfully and it being supported on 
actual NATs today? We are thinking of trying that out. 

Any other suggestions to get the packet through would also be
appreciated. SCTP and NAT was briefly covered in RFC 3257. Is there any
known implementation?

Thank you.
 
Regards,
Se-Hsieng

-----Original Message-----
From: Brian F. G. Bidulock [mailto:[email-masked]] 
Sent: Saturday, May 03, 2003 2:36 AM
To: Eng Se-Hsieng
Cc: [email-masked]
Subject: Re: FW: INIT from private IP address to public IP address never
received

Eng,

Could you explain the situation more?

--brian

On Fri, 02 May 2003, Eng Se-Hsieng wrote:

> > That means you are using NAT.  The NAT firewall almost certainly 
> > does NOT support SCTP.  I don't know of ANY SCTP NAT firewalls 
> > available yet.
> 
> Below is the tcpdump output from the operator, although it's probably 
> not the NAT machine. Two surprising things occured.
> 
> 1. DNS queries of the source machine hostname (CYRILLE) with 
> variations CYRILLE.nus.edu.sg and CYRILLE
> 
> 2. for every SCTP packet sent, we noticed one corresponding ICMP 
> packet on Ethereal, from the operator's network, with the Destination 
> Unreachable (3) code and Host Unreachable subcode (1). Surprisingly, 
> the Protocol Unreachable subcode wasn't received.
> 
> Would anyone happen to have any ideas on what these ICMP packets are 
> for or why the DNS queries are carried out? Path MTU discovery?
> 
> Also, what are the chances of UDP encapsulation being supported on 
> actual NATs today? We are thinking of trying that out.
> 
> Thank you.
> 
> Regards,
> Se-Hsieng
> 
> 14:30:39.826588 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:30:39.947056 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:30:45.826561 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:30:57.126663 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:31:21.266795 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:32:12.178799 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48 
> 14:33:04.639663 I 172.22.83.100.32770 > 137.132.123.4.53:  53768+ A? 
> CYRILLE.nus.edu.sg. (36) (DF) 14:33:04.659178 O 137.132.123.4.53 > 
> 172.22.83.100.32770:  53768 NXDomain* 0/1/0 (83) 14:33:05.719556 I 
> 172.22.83.100.32770 > 137.132.123.4.53:  53769+ A? CYRILLE. (25) (DF) 
> 14:33:05.724976 O 137.132.123.4.53 > 172.22.83.100.32770:  53769 
> Refused 0/0/0 (25) 14:33:06.399734 I 172.22.83.100.32770 > 
> 137.132.5.2.53:  53769+ A? CYRILLE. (25) (DF) 14:33:06.405689 O 
> 137.132.5.2.53 > 172.22.83.100.32770:  53769 Refused 0/0/0 (25) 
> 14:33:07.279830 I 172.22.83.100.32770 > 137.132.123.4.53:  53769+ A? 
> CYRILLE. (25) (DF) 14:33:07.285648 O 137.132.123.4.53 > 
> 172.22.83.100.32770:  53769 Refused 0/0/0 (25) 14:33:07.999634 I 
> 172.22.83.100.32770 > 137.132.5.2.53:  53769+ A? CYRILLE. (25) (DF) 
> 14:33:08.859617 I 172.22.83.100 > 137.132.165.146: ip-proto-132 48
> 
> 
> 

-- 
Brian F. G. Bidulock    | The reasonable man adapts himself to the |
[email-masked]    | world; the unreasonable one persists in  |
http://www.openss7.org/ | trying  to adapt the  world  to himself. |
                        | Therefore  all  progress  depends on the |
                        | unreasonable man. -- George Bernard Shaw |

---

From: "Brian F. G. Bidulock" <[email-masked]>
Date: Tue, 6 May 2003 01:04:09 -0600

Eng,

Just a guess, but because your NAT/Firewall box received an ICMP
error, it might be doing single or double forward or reverse DNS
lookups to generate detailed information (verified hostname) in
logs.

Actually simple NAT or IP masquerading is quite simple to do
provided that all multihomed addresses home off the same NAT.
There was a basic implementation in the 2.2.12 Linux kernel version
of OpenSS7 SCTP.  This has been roughed into the 2.4.18 version and
would only require minor work to make it functional.  It would
probably be easier than trying to massage a current SCTP implementation
into operating over UDP.

--brian

-- 
Brian F. G. Bidulock    ¦ The reasonable man adapts himself to the ¦
[email-masked]    ¦ world; the unreasonable one persists in  ¦
http://www.openss7.org/ ¦ trying  to adapt the  world  to himself. ¦
                        ¦ Therefore  all  progress  depends on the ¦
                        ¦ unreasonable man. -- George Bernard Shaw ¦