We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byAlexzander Tassell
Modified over 2 years ago
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. NAT (NAPT/PAT), STUN, and ICE `Structure of ice II, viewed along the hexagonal c-axis. Hydrogen bonds between the water molecules are shown as dashed lines. Lengths are in angstroms.'' (Hobbs, 1970, p. 69, reproduced from Hamilton et al., 1969). Ice II exists only at pressures greater than 2000 atmospheres.
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. NAT and NAPT/PAT NAT = Network Address Translation NAPT = Network Address and Port Translation, PAT=Port Address Translation Reserved & Publicly non-routable address space –Class A: 10.x.x.x –Class C: 192.168.x.x –Even smaller: 172.16.x.x to 172.31.x.x NAT – 1:1 mapping between private & public ip addresses
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. NAPT/PAT N:1 (private to public). Uses ports to provide further granularity for routing on the private side. Helps with the problem of ip address exhaust (IPV4). Many different flavors: Full Cone, Half Cone or Strict, Symmetric, etc. NAPT BREAKS PROTOCOLS THAT BURY THE IP ADDRESS INSIDE OF THE APPLICATION LAYER (e.g., all the VoIP Signaling Protocols: SIP, H323, MGCP as well as RTP). STUN (and other) client protocols (TURN, etc.) used to discover the private to public mappings, and to overcome the problem created by NAPT. Take a look at new STUN (RFC 5389) –Note: traditional STUN doesn’t work with symmetrical (or bi-directional) NAT, which is what most high class firewalls use. (I’m not sure what’s implemented in your voip clients – would be interesting to know). I’m told that TURN solves this, and perhaps has been incorporated into 5389. Session Border Controllers (server side) also can be used to fix the problems created by NAPT.
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. Full Cone: Very Popular on Broadband routers Each private IP:Port is mapped to a single public IP:Port on the public side of the router, regardless of destination IP address. For TCP connections, the mapping is typically session state-full (stays up until timeout or ended) For UDP connections, the “pinhole” is opened for a short time (seconds). Typically, the response from the destination must go BACK to the same ip:port as the source to get through. In the SIP world, registration by the client to the server is often used to keep the pinhole open to the destination sip server. What’s a potential problem with this.
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. Problem with full cone NAPT? The foreign ip address is never checked by the NAT router (since the same public IP:port is used to map to a given host - private IP:port – for all foreign ip addresses). “Bad guys” can send scan the ports of a given public ip address and send malicious packets to hosts behind the NAPT. This problem is corrected using “strict” NAPT – in which the router checks the foreign ip address before forwarding the packet to a host behind the NAPT.
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. Strict NAPT: Corrects Full Cone vulnerability For each private IP:Port and destination IP:Port there is a separate public IP:port on the public side of the NAPT router
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. Routing Tables Full Cone: For each host ip:port there is one public ip:port regardless of destination ip:port. Source privateSource publicDestination public 10.1.1.1:5060184.108.40.206:10566220.127.116.11:5060 18.104.22.168:5060 Source privateSource publicDestination public 10.1.1.1:506022.214.171.124:10566126.96.36.199:5060 10.1.1.1:5060188.8.131.52:12268184.108.40.206:5060 10.1.1.1:5062220.127.116.11:1237218.104.22.168:5062 10.1.1.2:506022.214.171.124:12384126.96.36.199:5060 Strict (partial cone): For each host ip:port & destination ip address:port, there is one public ip:port.
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. STUN: Simple Traversal of UDP Networks USED to “discover” the public address:port mapping from the private side of the network. STUN client STUN server in the network, which echo’s information back. Asks different questions (scans ip address and ports) to answer the question – what type of NAT is running on your broadband router, and how to modify the private ip address’ and ports to make the protocol(s) work!
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. Example of a STUN Session
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. STUN Debug (continued)
Copyright 2005 – 2009 © by Elliot Eichen. All rights reserved. STUN Decision Tree (see Wikipedia) http://en.wikipedia.org/wiki/File:STUN_Algorithm3.svg
STUN Date: Speaker: Hui-Hsiung Chung 1.
STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs) speaker ： Wenping Zhang date ：
1 © 2004 Cisco Systems, Inc. All rights reserved. Making NATs work for Online Gaming and VoIP Dr. Cullen Jennings
1 NAT & RTP Proxy Date: 2009/7/2 Speaker: Ni-Ya Li Advisor: Quincy Wu.
SIP Traversal over NAT Problems and Solutions Mr. Ting-Yun Chi May 2,2006 (Taiwan,NICI IPv6 R&D Division)
CS 4700 / CS 5700 Network Fundamentals Lecture 15: NAT (You Better Forward Those Ports) Revised 3/9/2013.
SIP, NAT, Firewall SIP NAT Firewall How to Traversal NAT/Firewall for SIP.
Section 461. ARP Ghostbusters Grew up in Lexington, KY Enjoy stargazing, cycling, and mushroom hunting Met Mario once (long time ago)
Ch. 23, 25 Q and A (NAT and UDP) Victor Norman IS333 Spring 2015.
1 © 2005 Cisco Systems, Inc. All rights reserved. Cisco Confidential Session Number Presentation_ID STUN, TURN and ICE Cary Fitzgerald.
1 Network Address Translation. 2 Network Address Translation (NAT) Extension of original addressing scheme Motivated by exhaustion of IP address space.
SIP and NAT Dr. Jonathan Rosenberg Cisco Fellow. What is NAT? Network Address Translation (NAT) –Creates address binding between internal private and.
Voice Over Internet Protocol (VoIP) Copyright © 2006 Heathkit Company, Inc. All Rights Reserved Presentation 11 – VoIP Hardware.
Security, NATs and Firewalls Ingate Systems. Basics of SIP Security.
NATs and UDP Victor Norman CS322 Spring NAPT Suppose we have a router doing NAT: half is the “public side”, IP address ; other half is.
9/11/2015Home Networking1 Bob.test Have Road Runner Unhappy about reports of constant probes of machines Policy decision –I want to prevent unauthorized.
CMPE 150- Introduction to Computer Networks 1 CMPE 150 Fall 2005 Lecture 25 Introduction to Computer Networks.
SIP, Firewalls and NATs Oh My!. SIP Summit SIP, Firewalls and NATs, Oh My! Getting SIP Through Firewalls Firewalls Typically.
1 IP: putting it all together Part 2 G53ACC Chris Greenhalgh.
Kittiphan Techakittiroj (25/06/59 19:10 น. 25/06/59 19:10 น. 25/06/59 19:10 น.) Network Address Translation Kittiphan Techakittiroj
Middleboxes & Network Appliances EE122 TAs Past and Present.
Chapter 6 Network Address Translation (NAT). Network Address Translation Modification of source or destination IP address Needed by networks using.
1 NAT Traversal for VoIP Ai-Chun Pang Graduate Institute of Networking and Multimedia Dept. of Comp. Sci. and Info. Engr. National Taiwan University.
CST Computer Networks NAT CST 415 4/10/2017 CST Computer Networks.
January 23-26, 2007 Ft. Lauderdale, Florida An introduction to SIP Simon Millard Professional Services Manager Aculab.
NAT/Firewall Traversal April NAT revisited – “port-translating NAT”
Simon Millard Professional Services Manager Aculab – booth 402 The State of SIP.
STUN Tutorial Jonathan Rosenberg Chief Technology Officer.
Network Address Translation Sandip Chakraborty. NAT PRIVATE NETWORK PUBLIC NETWORK IP: Port: 8123 IP: Port: 9678 IP:
NAT/PAT by S K SATAPATHY
RTP Relay Support in Intelligent Gateway Author: Pieere Pi
CS 4700 / CS 5700 Network Fundamentals Lecture 13: Middleboxes and NAT (Duct tape for IPv4) Revised 3/9/2013.
Making SIP NAT Friendly Jonathan Rosenberg dynamicsoft.
CSE5803 Advanced Internet Protocols and Applications (7) Introduction The IP addressing scheme discussed in Chapter 2 are classful and can be summarised.
Support Protocols and Technologies. Topics Filling in the gaps we need to make for IP forwarding work in practice – Getting IP addresses (DHCP) – Mapping.
Mobile IP Traversal Of NAT Devices By, Vivek Nemarugommula.
P2P and NAT How to traverse NAT Davide Carboni ©
NAT and PAT. Topics RFCs 1597(obs by 1918), 1631,1917, 1918 & 1797 Network Address Translation – Static and Dynamic Port Address Translation Issues with.
Bjorn Landfeldt, The University of Sydney 1 NETS 3303 IPv6 and migration methods.
NAT1 Network Address Translation Dr. Danny Tsang Department of Electronic & Computer Engineering Hong Kong University of Science and Technology.
Network Address Translation (NAT) Prof. Sasu Tarkoma.
Network Layer by peterl. forwarding table routing protocols path selection RIP, OSPF, BGP IP protocol addressing conventions datagram format packet handling.
NAT Network Address Translation Presented by Snoopers Eduardo Segura Shenal Shroff Shinichi Nishiyama Suyou He Thu Nguyen.
What is NAT? In computer networking, network address translation (NAT) is the process of modifying network address information in datagram (IP) packet.
©2012 ClearOne Communications. Confidential and proprietary. COLLABORATE ® Video Conferencing Networking Basics.
Network Address Translation (NAT) Adj. Prof. Sasu Tarkoma.
Ch. 23, 25 Q and A (NAT and UDP) Victor Norman IS333 Spring 2014.
Introduction to Network Address Translation
HIP-Based NAT Traversal in P2P-Environments
© 2017 SlidePlayer.com Inc. All rights reserved.