Subject: NAT Traversal With ICMP Replies

From: Sabahattin Gucukoglu <[email-masked]>
Date: Thu, 1 Apr 2010 01:42:30 +0100

http://samy.pl/pwnat/

The idea is that NATs let back ICMP replies and send them to hosts behind them if they suspect them to be responses to messages sent from those hosts.  So, by making the reply fixed and having a server behind a NAT continuously sending the ICMP query that would elicit it, a server can learn a client's IP address, and thus begin communication without a central rendezvous server.

An interesting idea, for sure.  It might not be super efficient, and there's the question of whose network gets all these ICMP messages.  Are we using it anywhere already?

Cheers,
Sabahattin