Network Address Translation Research Articles

DNS Poisoning of Operating System Caches: Attacks and Mitigations

The Domain Name System (DNS) is a protocol supporting name resolution from Fully Qualified Domain Names (FQDNs) to the IP address of the machines corresponding to them. This resolution process is critical to the operation of the Internet, but is susceptible to a range of attacks. One of the most dangerous attack vectors is DNS poisoning where an attacker injects malicious entries into the DNS resolution forcing clients to be redirected from legitimate to malicious servers. Typically, poisoning attacks target a DNS resolver allowing attackers to poison a DNS entry for all machines that use the compromised resolver. However, recent defenses protect resolvers substantially limiting these attacks. In this paper, we present a new class of DNS poisoning attacks targeting the client-side DNS cache, which is used in mainstream operating systems, circumventing defenses protecting resolvers. We implemented the attack on Windows, Mac OS, and Ubuntu Linux machines. We also generalize the attack to work even when the client is behind a Network Address Translation (NAT) router. Our results show that we can reliably inject malicious DNS mappings, with on average, an order of tens of seconds. We also propose client-side mitigations and demonstrate that they can effectively mitigate the vulnerability.

Design and implementation of a software tester for benchmarking stateful NATxy gateways: Theory and practice of extending siitperf for stateful tests

Our siitperf is the world’s first RFC 8219 compliant free software SIIT (Stateless IP/ICMP Translation, also called stateless NAT64) benchmarking tool. It was written in C++ using DPDK (Intel Data Plane Development Kit). Our current effort aims to design and implement a test program for stateful NATxy gateways, including both stateful NAT64 and stateful NAT44 (also called NAPT: Network Address and Port Translation). Due to the object-oriented design of siitperf, it is feasible to extend it for stateful tests, while keeping its original design and features. In this paper, we introduce the problem of benchmarking stateful NATxy gateways and propose various solutions. We disclose the design and the most important implementation decisions of the stateful extension of siitperf. We prove the viability of our design and implementation by a functional NAT64 test and performing the maximum connection establishment rate, throughput, and frame loss rate measurements of the Jool stateful NAT64 implementation. We also carry out an initial performance estimation of the stateful extension of siitperf. Our tester is distributed as free software under the GPLv3 license for the benefit of the research, benchmarking and networking communities.

IDHOCNET-A Novel Protocol Stack and Architecture for Ad hoc Networks

Presently employed Internet Protocol (IP) stack possesses number of architectural problems. The issues like Dual/Overriding role of IP addresses, mobility, multi-homing etc are the limitations for the infrastructure oriented networks which even have support of Dynamic Host Configuration Protocol (DHCP), Domain Name System (DNS), Network Address Translation (NAT) servers, etc. Such issues are extremely complex to handle in the case of multi-hop wireless ad hoc networks which lack the support of any infrastructure component. The contemporary research direction for the improvement of present Internet architecture mainly focuses on the use of real identifiers instead of IP addresses for host identification in the network. However, the proposed architectures mostly discuss the infrastructure oriented network models and minimal research has been conducted in the direction of proposals for ad hoc networks. In this paper we provide a thorough discussion on the practical usage issues of IP based ad hoc network implementation. In order to resolve the present limitations of ad hoc networks, we describe an implementation of a novel identifier based ad hoc network protocol stack and architecture known as IDHOCNET (Identifier based ad hoc network). The architecture proposes a novel paradigm of identifier based applications for multi-hop wireless ad hoc environment. The proposed system further provides backward compatibility to support co-existence with IP based applications. As a proof of concept, the architecture has been implemented on Linux platform with WiFi interfaces. Various practical scenarios with architectural insight are presented to demonstrate the practicability of the proposed approach.

Inferring Hidden IoT Devices and User Interactions via Spatial-Temporal Traffic Fingerprinting

With the popularization of Internet of Things (IoT) devices in smart home and industry fields, a huge number of IoT devices are connected to the Internet. However, what devices are connected to a network may not be known by the Internet Service Provider (ISP), since many IoT devices are placed within small networks (e.g., home networks) and are hidden behind network address translation (NAT). Without pinpointing IoT devices in a network, it is unlikely for the ISP to appropriately configure security policies and effectively manage the network. Additionally, inferring fine-grained user interactions of IoT devices is also an interesting yet unresolved problem. In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting from an ISP’s perspective in consideration of practical issues like learning-testing asymmetry. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and the number of each type of device that share the same IP address. Our system can also detect user interactions and meanwhile identify their (concurrent) number through a multi-output regression model. Through extensive evaluation, we demonstrate that the system can generally identify IoT devices with an F1-Score above 0.999, and estimate the number of the same type of IoT device behind NAT with an average error below 5%. By studying 29 user interactions of 7 devices, we show that our system is promising in detecting user interactions.

Safe, modular packet pipeline programming

The P4 language and programmable switch hardware, like the Intel Tofino, have made it possible for network engineers to write new programs that customize operation of computer networks, thereby improving performance, fault-tolerance, energy use, and security. Unfortunately, possible does not mean easy —there are many implicit constraints that programmers must obey if they wish their programs to compile to specialized networking hardware. In particular, all computations on the same switch must access data structures in a consistent order, or it will not be possible to lay that data out along the switch’s packet-processing pipeline. In this paper, we define Lucid 2.0, a new language and type system that guarantees programs access data in a consistent order and hence are pipeline-safe . Lucid 2.0 builds on top of the original Lucid language, which is also pipeline-safe, but lacks the features needed for modular construction of data structure libraries. Hence, Lucid 2.0 adds (1) polymorphism and ordering constraints for code reuse; (2) abstract, hierarchical pipeline locations and data types to support information hiding; (3) compile-time constructors, vectors and loops to allow for construction of flexible data structures; and (4) type inference to lessen the burden of program annotations. We develop the meta-theory of Lucid 2.0, prove soundness, and show how to encode constraint checking as an SMT problem. We demonstrate the utility of Lucid 2.0 by developing a suite of useful networking libraries and applications that exploit our new language features, including Bloom filters, sketches, cuckoo hash tables, distributed firewalls, DNS reflection defenses, network address translators (NATs) and a probabilistic traffic monitoring service.

Leveraging Active Decremental TTL Measuring for Flexible and Efficient NAT identification

Malicious attacks can be launched by misusing the network address translation technique as a camouflage. To mitigate such threats, network address translation identification is investigated to identify network address translation devices and detect abnormal behaviors. However, existing methods in this field are mainly developed for relatively small-scale networks and work in an offline manner, which cannot adapt to the real-time inference requirements in high-speed network scenarios. In this paper, we propose a flexible and efficient network address translation identification scheme based on actively measuring the distance of a round trip to a target with decremental time-to-live values. The basic intuition is that the incoming and outgoing traffic from a network address translation device usually experiences the different number of hops, which can be discovered by probing with dedicated time-to-live values. We explore a joint effort of parallel transmission, stateless probes, and flexible measuring reuse to accommodate the efficiency of the measuring process. We further accelerate statistical counting with a new sublinear space data structure Bi-sketch. We implement a prototype and conduct real-world deployments with 1000 volunteers in 31 Chinese provinces, which is believed to bring insight for ground truth collection in this field. Experiments on multi-sources datasets show that our proposal can achieve as high precision and recall as 95% with a traffic handling throughput of over 106 pps.

Evaluation of reactive service function path discovery in symmetrical environment

In this paper we continue our study of path discovery process for Service Function Chaining (SFC) in Software Defined Network (SDN). By default, service function (SF) paths are established proactively - before data transmission takes place. We have argued that this constraint can be eliminated with the use of our proposed Reactive SF path discovery approach. Such SFs as network address translation (NAT) or stateful firewall (FW) are SF path's symmetry dependent requiring a visit of both ingress and egress flows. Thus, we evaluated SF path discovery processes in Mininet emulation network. Outcome of this study is a comparison of proactive and reactive SF path discovery processes for both asymmetrical and symmetrical SF paths. It shows that even in symmetrical environment reactive SF path discovery has a higher probability of successful SF path detection.

Research on the Application of the IPv6 Network Protocol

With the rapid development of computer network technology, network applications have been very popular in people’s lives and work. The computer network technology includes many aspects, mainly including the communication technology and the computer technology. Although the network application has been relatively impeccable now, although people can contact anyone anywhere at any time through the network, it is still not perfect enough, and there are still great bottlenecks in the network technology. The network protocol plays an important role in the network technology. At present, the IPv4 protocol is more widely used in the Internet than others. Although the IPv6 protocol also has some applications, it is used less widely. For this reason, it is very necessary to research the application of the IPv6 network protocol. This paper mainly studies the main technical performance of the IPv6 network protocol, and introduces its application with specific examples. This paper analyzes the tunnel technology, network address translator technology and dual-stack technology of IPv6. And this paper introduces the basic configuration of the IPv6 address and of the static routing according to a specific type of router.

SPEChecker: Checking the feasibility of Slow-port-exhaustion attack on various hypervisors

Nowadays, with the emergence of IoT technologies, the number of devices connected to the Internet is rapidly increasing. As a result, Network Address Translation (NAT) mechanism is widely used to let multiple devices within a private network make use of a fewer number of public IP addresses. In this research, we focus on Port Address Translation (PAT), an extension of the NAT mechanism that can translate both the IP address and the port number of a TCP/IP packet. An apparent downside of PAT is the fact that when all of the ports are used, no more new outbound connections could be made from the local addresses. In 2018, we introduced Slow-port-exhaustion DoS Attack on a virtual network, a novel type of DoS Attack that exploits some flaws of the TCP protocol and the limitation of the PAT mechanism. In this attack, a compromised internal virtual machine with a low amount of attack bandwidth can occupy the host machine’s ports for a long time and therefore makes other machines on the same virtual network could not connect to the external network. In this paper, we present SPEChecker, a testing tool that can be used to check the feasibility of the Slow-port-exhaustion attack on virtual networks. In the analysis, we also explore a case of a TCP Host that could support this attack. Our testing results also show the potential of SPEChecker in evaluating virtual network security.

On the Effective Parallelization and Near-Optimal Deployment of Service Function Chains

Network operators compose Service Function Chains (SFCs) by tying different network functions (e.g., packet inspection, flow shaping, network address translation) together and process traffic flows in the order the network functions are chained. Leveraging the technique of Network Function Virtualization (NFV), each network function can be “virtualized” and decoupled from its dedicated hardware, and therefore can be deployed flexibly for better performance at any appropriate location of the underlying network infrastructure. However, an SFC often incurs high latency as traffic goes through the virtual network functions one after another. In this article, we first design an algorithm that leverages virtual network function dependency to convert an original SFC into a parallelized SFC (p-SFC). Then, to deploy multiple p-SFCs over the network for serving a large number of users, we model the deployment problem as an Integer Linear Program and propose a heuristic, ParaSFC, based on the Viterbi dynamic programming algorithm to estimate each p-SFC's occupation of the bottleneck resources and adjust the processing order of the p-SFCs in order to approximate the optimal solution. Finally, we conduct extensive trace-driven evaluations and exhibit that, compared to the Greedy method and the state-of-the-art CoordVNF method, ParaSFC reduces the average service latency of all the deployed p-SFCs by about 15 percent through parallelization while accommodating more SFC deployment requests over resource-limited networks.

Virtual network function placement with bounded migrations

With the penetration of Network Function Virtualization (NFV), network functions, traditionally deployed as proprietary physical equipment like firewalls, Network Address Translations (NATs), are gradually being implemented as software and deployed on standardized hardware. One of the crucial challenges in this paradigm is how to place the software implemented network functions to minimize the number of used physical servers. In this paper, we study the problem of how to optimally place Virtual Network Functions (VNFs) in networks where it is allowed to migrate already placed VNFs to decrease used servers. We first formulate the offline problem as an Integer Linear Programming (ILP) problem, and then propose a semi-online algorithm to solve the online variant of the problem. We name the proposed algorithm Semi-onlIne Vnf plAcement (SIVA). In particular, SIVA is based on a bin packing algorithm that solves online bin packing problem while taking care of migrations. According to our theoretical analysis, SIVA migrates at most $$\lambda$$ VNFs each step, and it has Asymptotic Competitive Ratio (ACR) of 3/2 if $$k \rightarrow \infty$$ , where $$\lambda = k \cdot |N|$$ , k is a tunable parameter, and $$|N|$$ is the the number of supported VNF types. We conduct extensive numerical simulations to evaluate the performances of SIVA. The experiment results validate the theoretical analysis and show that SIVA outperforms the state-of-the-art algorithms by achieving near-optimal performance with minor VNF migrations.

IPvest: Clustering the IP Traffic of Network Entities Hidden Behind a Single IP Address Using Machine Learning

IP Networks serve a variety of connected network entities (NEs) such as personal computers, servers, mobile devices, virtual machines, hosted containers, etc. The growth in the number of NEs and technical considerations has led to a reality where a single IP address is used by multiple NEs. A typical example is a home router using Network Address Translation (NAT). In organizations and cloud environments, a single IP can be used by multiple virtual machines or containers running on a single device. Discovering the number of NEs served by an IP address and clustering their traffic correctly is of value in many use cases for security, lawful interception, asset management, and other purposes. In this paper, we introduce IPvest, a system that incorporates unsupervised and supervised learning algorithms based on various features for counting and clustering network traffic of NEs masqueraded by a single IP. The features are based on the characteristics of operating systems (OSs), NAT behavior, and users' habits. Our model is evaluated on real-world datasets including Windows, Linux-based, Android, and iOS-based devices, containers, virtual machines, and load-balancers. We show that IPvest can count the number of NEs and cluster their traffic with high precision, even for containers running on a single device and servers behind a load-balancer.

Research on User Dynamic Selection Network Technology

Abstract As the world has entered the Internet era, more and more network operators have also developed one after another, which has been widely used in communities, schools, banks and other regions. Due to the uneven distribution of network providers in different regions, a certain network line is not running smoothly. In order to solve this problem, this paper puts forward a method that users can dynamically choose networks according to their preferences, and the problem can be solved by static routing and network address translation. At first, set the internal IP addresses of different users and the external IP addresses provided by internet providers on the ports on both sides of the user LAN router. During network address translation, a fixed one-to-one relationship established by the internal IP and the external IP is loaded into the routing table of the user LAN as a static route. Finally, users can actively and dynamically set the internal IP of the user LAN router in the router list in the user computer and realize the method that the user dynamically selects different interconnection networks.

A Novel Method for Resource Efficient Security Service Chain Embedding Oriented to Cloud Datacenter Networks

An important and promising application for the network function virtualization (NFV) technology is in network security, where can dynamically and flexibly accomplish the chaining virtualized security network functions (VSNFs), e.g., network address translation, antispam and packet filter firewall, etc., and thus inspect, monitor or filter traffic flows in the cloud datacenter networks. However, the traffic flows addressed by the VSNFs mainly depend on the security service requirements from mobile users, such as the network security level, end-to-end latency, and security resource, etc. Considering the dynamic nature of cloud datacenter networks, determining the embedding of VSNFs and routing security service paths that optimizes the security resource utilization is a challenging problem, particularly without violating the end-to-end delay constraints and security service requirements. This can also be called security service chain dynamic embedding problem (SSC-DMP). In this paper, we present an NFV-enabled framework for a system that achieves the SSC dynamic embedding in the cloud datacenter networks. We first formulate an integer linear programming (ILP) model to solve the SSC-DMP exactly in small-scale network topology. Then, in order to reduce the time complexity when applying the large-scale network topology, we propose an efficient SSC dynamic embedding solution that is based on the particle swarm optimization. Extensive simulation results show that the proposed algorithm could significantly outperform the current benchmarks at least 35.2% and 23.1% in terms of resource consumption and end-to-end delay, respectively.

Research on ISPs Selection Technology Based on Network Quality Monitoring

Abstract With the development of the network era, ISP have become more than one. Users can choose ISP according to personal preference when buying broadband, to provide users with the right to choose. However, with the improvement of network speed and bandwidth, people still feel the network congestion during peak hours. In this paper, users can choose different ISPs dynamically based on network quality monitoring. In this paper, the HTTP protocol of the application layer is used to accurately measure the real Internet situation of users, and the PC is used to actively send data to two network links at the same time, and finally the feedback parameter information can be obtained. According to this protocol, the real loading time of data can be accurately measured and the optimal ISP link can be selected. Then, a one-to-one relationship between the client address and different ISPs is established, and this relationship is saved in the routing table. Users will dynamically choose different ISPs by using the network address translation.

Virtual IP-based Secure Gatekeeper System for Internet of Things.

The advantage of using the Network Address Translation device is that the internal IP address, which makes the IP address space of Internet of Things (IoT) devices expanded, is invisible from the outside and safe from external attacks. However, the use of these private IPv4 addresses poses traversal problems, especially for the mobile IoTs to operate peer-to-peer applications. An alternative solution is to use IPv6 technologies for future IoT devices. However, IPv6 package, including IPSec, is too complex to apply to the IoT device because it is a technology developed for the user terminal with enough computing power. This paper proposes a gatekeeper to enable the real IP addresses of IoTs inside the same subnetwork to be not explicitly addressable and visible from outside of the gatekeeper. Each IoT device publishes its virtual IP address via the Registrar Server or Domain Name System (DNS) with which the gatekeeper shares the address mapping information. While the gatekeeper maintains the mapping information for the local IoT devices, the registration server or DNS has global address mapping information so that any peer can reach the mapping information. All incoming and outgoing packets must pass through the gatekeeper responsible for the address conversion and security checks for them from the entrance. This paper aims to apply our gatekeeper system to a platform of self-driving cars that allows surrounding IoT cameras and autonomous vehicles to communicate with each other securely, safely, and rapidly. So, this paper finally analyzes improvement effects on latency to show that our gatekeeper system guarantees the latency goal of 20 ms under the environment of 5G links.

Beware: NAT Traversal is a Simple and Efficient Approach to Open Firewall Holes

NAT traversal techniques allow processes with private, non-routable IP addresses to communicate with other processes outside the network secured limits. Techniques such as UDP Hole Punching have been standardized by the IETF, and using tunnels based on those techniques it is easy to allow application processes on top of any transport protocol, including TCP, to both start and receive packets from the Internet across NAT devices. However, as a side effect those techniques also freely proceed through firewalls. In this work we describe how it is possible to configure any server running on any port (no firewall configuration required) to establish connections initiated at arbitrary Internet clients, making unauthorized services easily available. We also show that the process is lightweight, in particular after the initial setup is concluded, thus virtually supporting any type of unauthorized applications.

NAT++: An Efficient Micro-NAT Architecture for Solving IP-Spoofing Attacks in a Corporate Network

The Internet Protocol (IP) version 4 (IPv4) has several known vulnerabilities. One of the important vulnerabilities is that the protocol does not validate the correctness of the source address carried in an IP packet. Users with malicious intentions may take advantage of this vulnerability and launch various attacks against a target host or a network. These attacks are popularly known as IP Address Spoofing attacks. One of the classical IP-spoofing attacks that cost several million dollars worldwide is the DNS-amplification attack. Currently, the availability of solutions is limited, proprietary, expensive, and requires expertise. The Internet is subjected to several other forms of amplification attacks happening every day. Even though IP-Spoofing is one of the well-researched areas since 2005, there is no holistic solution available to solve this problem from the gross-root. Also, every solution assumes that the attackers are always from outside networks. In this paper, we provide an efficient and scalable solution to solve the IP-Spoofing problem that arises from malicious or compromised inside hosts. We use a modified form of Network Address Translation (NAT) to build our solution framework. We call our framework as NAT++. The proposed infrastructure is robust, crypto-free, and easy to implement. Our simulation results have shown that the proposed NAT++ infrastructure does not consume more than the resources required by a simple NAT.

Supervised Learning-Based Fast, Stealthy, and Active NAT Device Identification Using Port Response Patterns

Although network address translation (NAT) provides various advantages, it may cause potential threats to network operations. For network administrators to operate networks effectively and securely, it may be necessary to verify whether an assigned IP address is using NAT or not. In this paper, we propose a supervised learning-based active NAT device (NATD) identification using port response patterns. The proposed model utilizes the asymmetric port response patterns between NATD and non-NATD. In addition, to reduce the time and to solve the security issue that supervised learning approaches exhibit, we propose a fast and stealthy NATD identification method. The proposed method can perform the identification remotely, unlike conventional methods that should operate in the same network as the targets. The experimental results demonstrate that the proposed method is effective, exhibiting a F1 score of over 90%. With the efficient features of the proposed methods, we recommend some practical use cases that can contribute to managing networks securely and effectively.

The importance of the use of IPV6 as an internet migration protocol

The article states the need and importance of the migration from IPv4 to IPv6. All the information that this article contains was obtained from bibliographic research in several books and online papers, just as a survey with the people responsible for some companies’ IT Department, in which we were able to attain a thorough analysis about the migration from IPv4 to IPv6. The currently situation of companies’ systems have been unreasonably unstable with Carrier Grade Network Address Translation - CGNAT, a technique used by internet service providers to share IPv4 public addresses inside private network addresses. Some research indicates that a large amount of IT professionals are suitable to use the IPv6 migration system as well as states that there are several resources and technics for implementation of this new system, however there has to be caution while using dual stacks and tunnels from the more recent system, the IPv6, because some services still are operated by the older system, the IPv4, as long as it continues existing and being used. Nowadays, several internet providers have adopted a new way of using the IPv4 and the IPv6, but the industry lacks business owners or internet managers with the right conscious to obtain the equipment’s that endure the migration to IPv6.