1. IPv4+4 Address extension with NATs Zoltán Turányi András Valkó Andrew Campbell (Rita)

2. Problem: IPv4 address shortage IPv6 There for 6+ years No deployment Complicated transition Little incentives NAT Deployed Breaks end-to-end Breaks apps Single point of failure Not scalable Even more deployed

3. Why are NATs so popular? Very easy –No need to replace routers –No need to get more addresses Provide address isolation –Easy address planning independent of outside –Provider change does not result in renumbering –Some even think it is security

4. IPv4+4 Use existing multiple address realms NAT A B X X A.X B.X level 1 part level 2 part

5. IPv4+4 Use existing multiple address realms NAT 9.8.7.6 5.4.3.2 10.0.0.1 9.8.7.6.10.0.0.1 5.4.3.2.10.0.0.1

6. IPv4+4 packet versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 transport header + payload 233 covers addresses, len & protocol end-to-end

7. IPv4+4 routing RGW A B X Y A.X B.Y X B A Y X B A Y A B X Y A B X Y A Y X B packet routable based on IP header private addresses not visible in public realm private realm’s addresses not visible in another private realm

8. IPv4+4 routing RGW A B X C A.X C.0 X C A 0 X C A 0 A C X 0 4.3.2.1.0.0.0.0

9. IPv4+4 routing RGW A B Y C C.0 B.Y C B 0 Y C B 0 Y C Y 0 B

10. ICMP translation R R A RGW A B X Y R.0 A.X X B A Y A B X Y

11. ICMP translation R RGW A B X Y X B A Y A B X Y R A A Y X B B.R A.X

12. ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source portdestination port sequence number (TCP)/length+checksum (UDP)

13. ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 source portdestination port sequence number (TCP)/length+checksum (UDP)

14. ICMP – a problem versionhdrlen DS bytetotal length identificationfragment offsetflags TTLprotocolheader checksum source address destination address source address 2 destination address 2 protocol 2sposdposheader checksum 2 source portdestination port sequence number (TCP)/length+checksum (UDP)

15. Summary - RGWs Legacy NAT Packet out: swap source Packet in: swap destination Add 4+4 header to ICMP messages Stateless, cheap processing

16. Summary – End hosts Generate & understand 4+4 header Decide if peer is in the same realm or not Obtain 4+4 addresses of peers –DNS –Configuration Application support needed

17. Implementation Linux kernel module Translates IPv4+4 packets and addresses –128.59.67.131.192.168.0.2 1.0.0.2 Mappings are dynamically created –Incoming packet –DNS request Packet headers inside ICMP errors DNS messages also affected

18. Implementation Linux kernel module – no kernel patch Load/unload any time KERNEL Module Applications userland kernel space

19. Implementation Linux kernel module – no kernel patch Uses netfilter hooks –Can examine and modify packet –Say a verdict: accept, drop, steal, queue Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD

20. Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INLOCAL_OUT FORWARD LOCAL_OUT If an ICMP error that carry a peer id inside => translate If destination is a peer id => translate LOCAL_IN If an ICMP error that carry a 4+4 packet => translate If v4+4 and addressed to us => translate If a DNS packet => QUEUE daemon QUEUEACCEPT

21. Applications Input deviceOutput device PRE_ROUTINGPOST_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD FORWARDING ICMP error carrying 4+4 packet => add IPv4+4 header 4+4 packet => swap source address PRE_ROUTING ICMP error carrying 4+4 packet => add IPv4+4 header 4+4 packet => swap destination address

22. DNS Each 4+4 address is stored as two “A” RR Name prepending is used as with SRV RRs Hostname: pleione.comet.columbia.edu. Records: l1.pleione.comet.columbia.edu 128.59.67.131 l2.pleione.comet.columbia.edu192.168.0.2 IPv4+4 address:128.59.67.131.192.168.0.2

23. DNS Kernel App Module Daemon Who is a.b.com? a.b.com doesn’t exist. Who is l1.a.b.com? Who is l2.a.b.com? l1.a.b.com is 2.3.4.5 l2.a.b.com is 6.7.8.9 Mapping: 2.3.4.5.6.7.8.9  1.0.0.2 a.b.com is 1.0.0.2

24. Testbed aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1 DNS server WEB server ipv44.comet.columbia.edu WEB server pleione.ipv44.comet.columbia.edu pc11 195.228.209.132 Budapest, Hungary Comet Lab New York

25. aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1

26. aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1

27. aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1

28. aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1

29. aphroditetaygeta 128.59.67.141128.59.67.131 pleione 192.168.0.2 192.168.0.1

30. Experiments Applications/protocols –icmp, ssh, scp, telnet, ping, http –arp, snmp, dhcp, routing protocols –ftp, irc Network management/configuration –dns, firewall, routing

31. Performance Pentium III, 1 GHz machine Unloaded Measured the forwarding time Applications Input deviceOutput device PRE_ROUTING LOCAL_INPUTLOCAL_OUTPUT FORWARD POST_ROUTING

32. Performance