1. Leone From global measurements to local management NATalyser inhome NAT detection Miguel Ángel Díaz, Francisco Valera

2. METRIC OBJECTIVE  General picture February Leone - From global measurements to local management 2 EXTERNAL NETWORKS

3. METRIC OBJECTIVE  General picture Leone - From global measurements to local management 3 EXTERNAL NETWORKS  What : evaluate NATs characteristics and 'behave' RFC compliance  The requirements are described in:  RFC 5382 for TCP  RFC 5508 for ICMP  RFC 4787 for UDP  Characterize the NATs by their configurations  Why: check possible problems for end user applications  Are ISPs aware of this? February

4. Executions Leone - From global measurements to local management 4  NATalyser has been executed on various countries… February 25 Inhome Nats

5. Testbed Leone - From global measurements to local management 5  …and also with several router vendors February

6. NATalyser Leone - From global measurements to local management 6 February Wifi NATs results3G/4G results Because they usually go through a CG Nat In Android there’s only a few tests because we cannot use Raw Sockets without root permissions

7. NATalyser Leone - From global measurements to local management 7 February Wifi NATs results InHome NATs -Residential -Probes Public NATs -Restaurants -Hotels / Shopping center Dataset 1 Android + Inhome tests 7 test Dataset 2 Inhome tests 28 test

8. Types of questions to answer  Do the ISPs implement always the same type of NAT?  Do the vendors implement always the same type of NAT?  Is there a main type of NAT?  Do an ISP implement always the same NAT within the same vendor?  … Leone - From global measurements to local management 8 February

9. Configurations  We are going to call “Configuration” to a specific combination of results for the tests  These two would be two different configurations 13rd February, 2013 Leone - From global measurements to local management 9

10. InHome NATs (Dataset 1) Leone - From global measurements to local management 10 Different tests having different behavior We still have a main class here February Between the two first classes there’s only one difference: The first one have the mapping lifetime on more than 2 minutes

11. InHome NATs (Dataset 1) Leone - From global measurements to local management 11 This one is from BT but from an unkown vendor February

12. InHome NATs (Dataset 1) Leone - From global measurements to local management 12 February

13. Dispersion by ISP/Vendor Leone - From global measurements to local management 13 BT February It seems that BT takes the same configuration for the same vendor for Huawei and almost for all of Sagem This one doesn’t have the mapping lifetime more than 2 minutes

14. Dispersion by ISP/Vendor February Leone - From global measurements to local management 14 Telecom Italia

15. InHome NATs (Dataset 1) February Leone - From global measurements to local management 15

16. InHome NATs (Dataset 1) February Leone - From global measurements to local management 16 Technicolor is present on Telecom Italia ( 11 probes) and in Tiscalinet, so all of them are on Italy. More than 50% of them fullfill the 100% of the requirements

17. InHome NATs (Dataset 1) February Leone - From global measurements to local management 17 All the SAGEM COMMUNICATIONS probes that BT owns are behavioring the same way by not having the TCP mapping endpoint independent Also, Huawei and Arcadyan from BT behave the same way, not implementing the binding lifetime > than 2 minutes and the outbound mapping renewal

18. General Image (Dataset 2) 13rd February, 2013 Leone - From global measurements to local management 18 There’s no clear configuration taking into account UDP, TCP and ICMP on all the measured InHome NATs

19. InHome NATs (Dataset 2) 13rd February, 2013 Leone - From global measurements to local management 19

20. Remarkable results  Overall picture 8th October, 2013 Leone - From global measurements to local management 20 EXTERNAL NETWORKS UDP

21. Configuration Distribution 13rd February, 2013 Leone - From global measurements to local management 21 These classes are marked by 4 tests being the total 11: -Mapping Lifetime -Mapping type -Filtering type -Preservation of the port All are from Telecom Italia being majority of them from the vendor Technicolor

22. Remarkable results  Overall picture 8th October, 2013 Leone - From global measurements to local management 22 EXTERNAL NETWORKS TCP

23. Configuration Distribution 13rd February, 2013 Leone - From global measurements to local management 23 From BT and unknown vendor (not localizable) From BT and Telecom Italia and unknown vendor and NETGEAR This class has Endpoint independent behavior This one hasn’t Endpoint independent behavior. Majority of Technicolor vendor In general, the vendors and the ISPs are well distributed between the 2 main classes

24. Remarkable results  Overall picture 8th October, 2013 Leone - From global measurements to local management 24 EXTERNAL NETWORKS ICMP

25. Configuration Distribution Leone - From global measurements to local management 25 None of the measured NATs have the support of the internal error of ICMP Again, the ISPs and Vendors are distributed on all the classes

26. Related Work 13rd February, 2013 Leone - From global measurements to local management 26 From L. D’Acunto, J. A. Pouwelse, and H. J. Sips, “A measurement of NAT and firewall characteristics in peer-to- peer systems,” in Proc. 15-th ASCI Conference, 2009, vol. 5031, pp. 1–5. Frequency distributions of NAT timeout for UDP

27. Related Work 13rd February, 2013 Leone - From global measurements to local management 27 From L. D’Acunto, J. A. Pouwelse, and H. J. Sips, “A measurement of NAT and firewall characteristics in peer-to- peer systems,” in Proc. 15-th ASCI Conference, 2009, vol. 5031, pp. 1–5.

28. Public NATs  We are starting to measure some public NATs such as:  Restaurants  Vips  Ginos  McDonalds  Cafeterias  Starbucks  Unknown ones  Shopping center’s Wifi Leone - From global measurements to local management 28 February

29. Configuration Distribution 13rd February, 2013 Leone - From global measurements to local management 29 This configuration does not allow any traffic that is not http The class is composed of the 100% of the Mcdonalds measured and 2 open Wifi from shopping centers The rest of the classes only differ on the TCP tests and the mapping lifetime This type of NAT does not have a mapping lifetime more than 2 minutes 60% of the NATs are from the RouterBoard.com vendor Also Arrakis Servicios Y Comunicaciones S.l. (BT group) has always the RouterBoard.com vendor All this NATs share one thing: None of them have the Mapping lifetime more than 2 minutes

30. Conclusions Leone - From global measurements to local management 30  NATalyser has been executed on  Sam’s testbed  Public open networks  Public registration network  In the future NATalyser will be executed on more environments in order to get more results. With this we want to have more data in order to get the distributions February