Network Address Translation Gateways Research Articles

Source attribution for network address translated forensic captures

Network Address Translation (NAT) is a technology allowing a number of machines to share a single IP address. This presents a problem for network forensics since it is difficult to attribute observed traffic to specific hosts. We present a model and algorithm for disentangling observed traffic into discrete sources. Our model relies on correlation of a number of artifacts left over by the NAT gateway which allows identification of sources. The model works well for a small number of sources, as commonly found behind a home or small office NAT gateway.

PF 41-packet forwarding for seamless use of IPv6 devices behind IPv4-only NAT gateways

This paper describes a PF (protocol field) 41-packet forwarding mechanism for seamless use of IPv6 devices behind IPv4-only NAT (network address translation) gateways. The PF 41-packet forwarding enables IPv6 nodes to set-up symmetric end-to-end connections with other IPv6 nodes located behind an IPv4-only NAT gateway. The symmetry, meaning both outgoing as well as incoming connections are possible, is one of the most important requirements for proper functioning of peer-to-peer applications like A/V conferencing, IP telephony and multi-user gaming.