Re: threats ID

[Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>]

Kurt;

> > > I believe NOID and certainly ODT allow layer 4 to work without 
> > > changes,
> >
> > You can believe so, just as you can believe NAT allow layer 4 to work
> > without changes.
>
>
> I think there is a notable difference. In my reading you are using NAT 
> very loose for all forms of address rewrite. NAT to me does static 
> rewrites, with no form of signaling.

Wrong. Rewriting is not the essential problem.

Right. The problem is lack of signaling OF *CONNECTIONS*.

As you might know, there is no connections and signaling at
the IP layer.

Thus, the only thing NAT and other layer 3 things can do is
guessing the connection state by a lack of communication
for certain period of time, though, sometimes, you can detect
TCP SYN and FIN.

However, that you observe no traffic over a connection does
not necessarily mean that the connection is broken.

That there is no response for a UDP packet may mean that an
reply ack is lost, that no reply is required by the protocol
above UDP or that the packet is an ack.

There is no signaling unless layer 4 and above are involved,
though guessing may work for TCP.

> Especially breaking referrals by 
> hiding the "true" address to the outside world. Most (if not all) 
> id/loc proposals here (claims) that referrals do work. There is a hugh 
> difference, referrals is a crucial component of any multi6 solution. 
> This was also pointed out in the comments by Patrick.

NAT rewriting is transparent to applicaitons, if the applications
relies on TCP and DNS and DNS is modified to reflect the rewriting.

So are other proposals, including mine, as is explained in
my proposal.

However, TCP is not IP, which is the point of my presentation
at Vienna.

						Masataka Ohta