Firewall/NAT box classification notes
This document is a start at what aspects of a system need to be classified in order to know how two peers over the internet may (or may not) be able to directly communicate.
This is just a start. Saikat will fill this out.
· LINUX or Windows (or, more to the point, can it do symmetric TCP or not?)
This section lists a number of things a client may need to know about its FW/NAT.
5. How does the NAT box deal with ICMP unreachables? This is similar to the FIN issue, and can be tested the same way, except using ICMP instead of FIN (see Figure 2).
6. What do FW/NAT boxes return when the receive packets with no associated mapping? For instance, do they return RST or ICMP unreachable (for TCP), ICMP unreachable (for UDP), or nothing? Figure 3 shows the test platform sending a SYN or a UDP packet and monitoring what is returned.
7. If the NAT box is symmetric, can we predict what port it will assign? One way to do that would be to establish lots of connections from the client to the test platform, and monitor what ports are used. (In Figure 4, A1 and A2 refer to addresses of the test platform. The test platform monitors the port assigned at the points identified by the dots in its time line. We could do this for UDP as well.
8. Find out if the policies for closing holes is different for TCP and UDP. For instance,