Subject: RE: Stupid NAT tricks and how to stop them.

From: [email-masked] (Noel Chiappa)
Date: Tue, 28 Mar 2006 09:57:46 -0500 (EST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

    > I have never seen a coherent, rational argument as to why the network
    > numbering on my internal network should be the same as the network
    > numbering on the Internet. All I hear is a restatement of the original
    > claim, the 'no you didn't' mode of argument.

Your terminology here is a little loose (I don't know exactly what you mean
by "network numbering"), but let me try and say something useful.

IP addresses currently serve two completely separate functions: they
identify *who* you are talking to, and they identify *where* they are.
Unfortunately, because one field is used to two purposes, the constraints on
that field are the union of the needs of the two purposes.

Let's look at the needs of the "where they are" function. When packets from
your hosts get to the server in, say, Paraguay, they have to have a
bit-string in the source field that says "these packets came from this place
that you now how to get to" - in other words, the bit-string has to have a
value that the routers in Paraguay recognize, if the return packets are
to get back to you.

Yes, yes, that bit-string could be added as the packets are leaving your
general area - but alas, this contradicts the needs of the *other* usage of
that field, which is that they identify who you are talking to. If we change
them around, you lose that functionality.

What you're seeing, quite simply, is a case where a shared mechanism has
ceased to work well as the system scaled up.
(This point is discussed in more detail in section 11.2, "Shared Mechanisms
and System Scale", of my never-completed endpoint spiel, available at:
http://users.exis.net/~jnc/tech/endpoints.txt if you wat more about it.)

Even if you split the two, however, there'd still be an argument as to why
your "network number[] on my internal network should be the same as the
network numbering on the Internet".

You'd still have the same problem, that the "where I am" field would have to
have a value that was meaningful to the router in Paraguay. If that meaningful
value was inserted by some router several steps away from you, there are a
host of issues that come up: security (what if that router is subverted, etc,
etc), complexity, etc, etc.

You can also look at the analogy to telephones and street addresses. In both
cases, the full form of the name is globally unique - because global
uniqueness has all sorts of useful properties. You need only look at personal
names to see some of the kind of very painful issues that crop up when they
aren't globally unique.

	Noel

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Keith Moore <[email-masked]>
Date: Tue, 28 Mar 2006 14:12:43 -0500

> identify *who* you are talking to, and they identify *where* they are.

there's a tad more to it than that which is essential:
in a non-NATted network, IP addresses identify where a host is in a way
that is independent of the location in which they're being evaluated.
in a NATted network, at least some IP addresses are location-dependent
which removes the ability to hand those addresses to a host in a different
part of the network.

even if IP had identifiers for hosts that were independent of locators,
they wouldn' t be worth very much without a way to map them to locators.
and locators are a lot easier to deal with if they're location-independent.