PeertoPeer Communication Across Network Address Translation

1
Peer-to-Peer CommunicationAcross Network Address
Translation
Bryan Ford, Pyda Srisuresh, Dan kegel

• Presented By
• Will Doutre

2
What is NAT?

• Mapping a hosts private endpoint (IP address and
  port number ) to a Gateways (Routers) public
  endpoint.
• Allows for many devices to use one IP address to
  access the Internet.
• Basic NAT (Address only, ports are not
  translated)
• NAPT (Address and port translation) Most common
  and the version used in the paper.

3
http//www.brynosaurus.com/pub/net/p2pnat-slides.p
df
4
UDP Hole Punching

• Peer A contacts Intermediary S and asks to speak
  to Peer B
• S gives Bs public and private endpoints to A
• A contacts B at the prescribed endpoints, opening
  return traffic from Bs endpoints to A
• S gives As public and private endpoints to B and
  asks B to contact A
• B contacts A at the prescribed endpoints, thereby
  opening return traffic from As endpoints to B

5
http//www.brynosaurus.com/pub/net/p2pnat-slides.p
df
6
What has to be true about the NAT devices to make
this work?
http//www.brynosaurus.com/pub/net/p2pnat-slides.p
df
7
P2P-Friendly NAT

• Consistent Endpoint Translation
• Leave packet payloads alone (Application is
  transmitting local endpoint in payload, if that
  is translated were screwed)
• Hairpin Translations Device must be able to
  communicate between two endpoints on its own
  public interface
• Gentle rejection of unsolicited communication

8
TCP Hole Punching

• Same Idea as UDP Hole Punching, but more
  complicated to implement. Why?

9
TCP Hole Punching

• Same Idea as UDP Hole Punching, but more
  complicated to implement. Why?
• Socket Bindings must use SO_REUSEADDR flag to
  allow application to bind multiple sockets to the
  same local endpoint
• TCP sockets API is client-server oriented must
  attempt to connect and be listening on the same
  endpoint

10
http//www.brynosaurus.com/pub/net/p2pnat-slides.p
df
11
NAT Check

• Tests for consistent identity preserving endpoint
  translation
• Tests for silent dropping of unsolicited incoming
  TCP SYNs (No Resets or errors)
• Tests Hairpin translation
• Tests for any incoming traffic filtering policies

12
NAT Check
13
NAT Check Results

• UDP Results

• TCP Results

• Hole Punching 82 (310/380)
• Belkin 100 (14/14)
• Cisco 100 (12/12)
• SMC 100 (12/12)
• Linksys 98 (45/46)
• Netgear 84 (31/37)
• D-Link 76 (16/21)
• Hairpin 24 (80/335)

• Hole Punching 64 (184/286)
• Belkin 100 (11/11)
• SMC 89 (8/9)
• Linksys 87 (33/38)
• Cisco 86 (6/7)
• Netgear 63 (19/30)
• D-Link 47 (9/19)
• Hairpin 13 (37/286)