Carrier-Grade NAT Research Articles

Optimizing the Performance of the Iptables Stateful NAT44 Solution

The stateful NAT44 performance of iptables is an important issue when it is used as a stateful NAT44 gateway of a CGN (Carrier-Grade NAT) system. The performance measurements of iptables published in research papers do not comply with the requirements of RFC 2544 and RFC 4814 and the usability of their results has serious limitations. Our Internet Draft has proposed a benchmarking methodology for stateful NATxy (x, y are in {4, 6}) gateways and made it possible to perform the classic RFC 2544 measurement procedures like throughput, latency, frame loss rate, etc. with stateful NATxy gateways using RFC 4814 pseudorandom port numbers. It has also defined new performance metrics specific to stateful testing to quantify the connection setup and connection tear down performance of stateful NATxy gateways. In our current paper, we examine how the performance of iptables depends on various settings, and also if certain tradeoffs exist. We measure the maximum connection establishment rate, throughput and tear down rate of iptables as well as its memory consumption as a function of hash table size always using 40 million connections. We disclose all measurement details and results. We recommend new settings that enable network operators to achieve significantly higher performance than using the traditional ones.

Collaborative and privacy-preserving estimation of IP address space utilisation

Exhaustion of the IPv4 address space is driving mitigation technologies, such as carrier-grade NAT or IPv6. Understanding this driver requires knowing how much allocated IPv4 space is actively used over time – a non-trivial goal due to privacy concerns and practical measurement challenges. To address this gap we present a collaborative and privacy-preserving capture-recapture (CR) technique for estimating IP address space utilisation. Public and private datasets of IP addresses observed by multiple independent collaborators can be combined for CR analysis, without any individual collaborator’s privately observed addresses leaking to the others. We show that CR estimation is much more accurate than assuming all used addresses are observed, and that our scheme scales well to datasets of over a billion addresses across several collaborators. We estimate that 1.2 billion IPv4 addresses and 6.5 million /24 subnets were actively used at the end of 2014, and also analyse address usage depending on RIR and country.

Availability of Required Data to Support Criminal Investigations Involving Large-Scale IP Address–Sharing Technologies

The use of large-scale IP address sharing technologies (commonly known as Carrier-Grade NAT and AP) presents a challenge for law enforcement agencies due to the fact that incoming source port information is not routinely logged by Internet-facing servers. The absence of this information means that it’s becoming increasingly difficult for law enforcement agencies to identify suspects in criminal activity online. In this article, the author considers the reasons source port information isn’t routinely logged and proposes some immediate actions that can be taken to help improve the situation.

Statistical network monitoring: Methodology and application to carrier-grade NAT

When considering to passively collect and then process network traffic traces, the need to analyze raw data at several Gbps and to extract higher level indexes from the stream of packets poses typical BigData-like challenges. In this paper, we engineer a methodology to extract, collect and process passive traffic traces. In particular, we design and implement analytics that, based on a filtering process and on the building of empirical distributions, enable the comparison between two generic collections, e.g., data gathered from two different vantage points, from different populations, or at different times. The ultimate goal is to highlight statistically significant differences that could be useful to flag to incidents for the network manager.After introducing the methodology, we apply it to assess the impact of Carrier-Grade NAT (CGN), a technology that Internet Service Providers (ISPs) deploy to limit the usage of expensive public IP addresses. Since CGN may introduce connectivity issues and performance degradation, we process a large dataset of passive measurements collected from an ISP using CGN for part of its customers. We first extract detailed per-flow information by processing packets from live links. Then, we derive higher level statistics that are significant for the end-users, e.g., TCP connection setup time, HTTP response time, or BitTorrent average download throughput. At last, we contrast figures of customers being offered public or private addresses, and look for statistically significant differences. Results show that CGN does not impair quality of service in the analyzed ISP deployment. In addition, we use the collected data to derive useful figures for the proper dimensioning of the CGN and the configuration of its parameters in order to avoid impairments on end-users’ experience.

A scalable and efficient IPv4 address sharing approach in IPv6 transition scenarios

IPv6 has been an inevitable trend with the depletion of the global IPv4 address space. However, new IPv6 users still need public IPv4 addresses to access global IPv4 users/resources, making it important for providers to share scarce global IPv4 addresses effectively. There are two categories of solutions to the problem, carrier-grade NAT (CGN) and ‘A+P’ (each customer sharing the same IPv4 address is assigned an excluded port range). However, both of them have limitations. Specifically, CGN solutions are not scalable and can bring much complexity in managing customers in large-scale deployments, while A+P solutions are not flexible enough to meet dynamic port requirements. In this paper, we propose a hybrid mechanism to improve current solutions and have deployed it in the Tsinghua University Campus Network. The real traffic data shows that our mechanism can utilize limited IPv4 addresses efficiently without degrading the performance of applications on end hosts. Based on the enhanced mechanism, we propose a method to help service providers make address plans based on their own traffic patterns and actual requirements.