Network Address Translation Traversal Research Articles

Decentralized Distribution of PCP Mappings Over Blockchain for End-to-End Secure Direct Communications

Network Address Translation (NAT) is a method that enables devices with private IP addresses to connect to the Internet by sharing a public IP address. Traversing the NAT device remains a challenge for a wide range of applications such as Voice over IP (VoIP) and Internet of Things (IoT). The Port Control Protocol (PCP) is a relatively new protocol standardized by the Internet Engineering Task Force (IETF) to solve the NAT traversal issues. It allows a NATed device to request and manage a mapping between its private IP address and transport-layer port to a public IP address and port. As PCP requires an application-dependent method for distributing the mappings to remote hosts, several attacks can target the distributing server and render the communication channel vulnerable. In this paper, we propose and implement a decentralized Blockchain-based approach for distributing PCP-mappings, enabling secure end-to-end (e2e) direct communications without any trusted third party server. NATed devices register their PCP mappings and public keys into the Blockchain, and other peers can then learn about these mappings to establish end-to-end secure direct communications. The implementation verifies that the system is feasible in terms of transactions fees, can simplify and secure end-to-end direct communications, and can interwork with conventional security methods.

Making Constrained Things Reachable

The widespread adoption of the Internet of Things (IoT) has created a demand for ubiquitous connectivity of IoT devices into the Internet. While end-to-end connectivity for IoT requires in practice IPv6, a vast majority of nodes in Internet are only IPv4-capable. To address this issue, the use of Network Address Translation (NAT) at the IoT network boundary becomes necessary. However, the constrained nature of the IoT devices hinders the integration of traditional NAT traversal architectures through IoT networks. In this article, we introduce a novel transition mechanism that transparently enables IoT devices behind NATs to connect across different network-layer infrastructures. Our mechanism adopts the IoT standards to provide a global connectivity solution in a transparent, secure, and elegant way. Additionally, we revisit the NAT solutions for IoT and describe and evaluate our current implementation.

An Effective NAT Traversal Mechanism for SIP/IMS Services in SDN-Enabled All-IP Mobile Networks

Network Address Translation (NAT) is the major solution to ease the IP address shortage problem and support the upcoming demands of huge IP address from the Machine-to-Machine communications and Internet of Things . However, NAT breaks the peer-to-peer communications and blocks the Internet-oriented requests. In order to resolve the problems, lots of NAT traversal solutions such as Session Traversal Utilities for NAT, Universal Plug-and-Play, Traversal Using Relay NAT, Application-Layer Gateway (ALG) and Interactive Connectivity Establishment have been proposed. Among the NAT traversal solutions, the 3rd Generation Partnership Project adopts the ALG solution for SIP/IMS multimedia services in the mobile networks. The ALG solution does not require modifications to the clients (e.g., User Equipments). However, the ALG solution utilizes the Real-time Transport Protocol (RTP) proxy to translate the RTP packets, and thus this solution produces extra delay and packet loss possibility to the RTP packets. In this paper, we integrate Software-defined networking (SDN) to the All-IP mobile networks and propose a solution to improve the ALG solution in the SDN-enabled All-IP mobile networks. We derive the analytic models for analyzing the ALG solution and the proposed solution, and compare these two solutions in terms of the throughput, loss rate and delay.

A Novel Solution based on NAT Traversal for High-speed Accessing the Campus Network from the Public Network

Chinese universities use the multi-outgoing exports to solve the problem of the traffic of bandwidth to the Internet for the campus network, but the world wide web servers in the campus network might still be accessed very slowly by some users outside the campus network (from the public network). We discuss and analyze the reasons for slowly accessing to the campus network form the public networks and a novel solution for high-speed accessing to the campus network for the local client in public network is put forward. We first introduce an NAT (Network Address Translation) traversal approach based on reverse TCP (Transmission Control Protocol) connection, which has the advantage of not requiring any intermediary server. We test our NAT traversal approach in real network environment and the results show that it is effective. Meanwhile, we also test the network performance between the campus network and the local public network after the NAT Router between them has been traversed by our approach and the results show that the network performance by the second export accessing to the campus network is much better than by the campus network export.

Mathematical Model of Network Address Translation Port Mapping

Network address translation (NAT) traversal is a critical technology for real-time video streaming between two endpoints. The port predictive algorithm of the NAT mapping rule is the core of NAT traversal. However, most port predictive algorithms in the NAT traversal method are too simple or unclear. The behavior of NAT port mapping in devices in real network environments is complex and cannot be accurately predicted. In this study, NAT port mapping behavior was examined and a mathematical model was established to enhance the port predictability of NAT and increase the success rate of NAT traversal.

On the performance and fairness of BitTorrent-like data swarming systems with NAT devices

There is no doubt that BitTorrent nowadays is one of the most popular peer-to-peer (P2P) applications on the Internet. On the other hand, Network Address Translation (NAT) has become pervasive in almost all networking scenarios. Despite the effort of NAT traversal, it is still very likely that applications, especially P2P ones, cannot receive incoming connection requests properly if they are behind NAT. In this paper, we build analytical models to characterize BitTorrent-like P2P systems with the presence of homogeneous and heterogeneous NAT peers, from which we observe and mathematically reason the poor download performance of NAT peers. Motivated by this observation, we further investigate the fairness metrics of the system, which reveal the fundamental problem of the BitTorrent unchoke mechanism: it is unaware of, and unfair to NAT peers. We thus propose a tunable optimistic unchoke strategy, in order to improve the overall system performance and fairness metrics considerably. The simulation results have validated our analytical models, and also the efficacy of our tunable optimistic unchoke strategy.

IMS에서 효율적인 NAT Traversal 해결 시나리오

IP 주소 공간의 부족 문제를 해결하기 위해 NAT(Network Address Translation) 기술을 활용할 수 있다. NAT의 주소 변환 테이블에 없는 바인딩과 관련된 패킷을 제거하는 필터링 특성 때문에 NAT Traversal 문제가 발생한다. 이러한 문제를 해결하기 위해 부가적인 장비를 활용한 여러 가지 방법들이 제시되었다. 최근의 네트워크 시장은 유선과 무선이 통합되는 형태로 발전하고 있으며, 이를 효과적으로 제어하기 위하여 IMS(IP Multimedia Subsystem)라는 유무선 통합 제어 망이 등장하였다. IMS에서 IBCF(Interconnection Border Control Function)와 IBGF(Interconnection Border Gateway Function)라는 부가적인 장비를 이용하여 NAT Traversal 문제를 해결하고 있다. 본 논문에서는 P-CSCF(Proxy-Call Session Control Function)를 활용하여 부가적인 장비를 사용하지 않고 NAT Traversal 문제를 해결하는 방안을 제안한다. We can use NAT(Network Address Translation) technology to solve the lack of IP address. The problem of NAT traversal is happened when the filtering characteristics of NAT remove the packet that has no binding in the address translation table of NAT. There were many kinds of way to solve these problems by using additional device. Lately, network market is changed into integrating wired and wireless network by the IMS(IP Multimedia Subsystem). The IMS integrates to control network of wired and wireless network, has emerged to control convergence network effectively. Lately, the additional devices like IBCF(Interconnection Border Control Function) and IBGF(Interconnection Border Gateway Function) are used to solve the NAT traversal problem in the IMS. In this paper, we propose the solution of NAT traversal using P-CSCF without any additional equipment in the IMS.

WiFi assisted NAT traversal scheme for surveillance patrol robot

With the advances in wireless communication technology and artificial intelligence, robots are gradually being introduced as part of our life. Previous research proposed a SIP-enabled Surveillance Patrol Robot (SSPR), which tracks a moving object actively and informs the householder of such security alarm. However, the underlying signaling protocol for communication and data streams suffer from the network address translation (NAT) traversal problem as most peer-to-peer (P2P) applications. NAT is a commonly adopted technique to share one public IPv4 address among several hosts located behind a NAT device for alleviating the exhaustion of IPv4 address. NAT devices typically block session requests originating from outside, prevent the establishment of peer-to-peer (P2P) sessions and cause NAT traversal problem. This study proposes WANTS, a WiFi Assisted NAT Traversal Scheme for SSPR. When SSPR is activated, it retrieves the topology information from a server to choose the candidate access point (AP) for handoff. Then SSPR uses the collected network context information to assist its NAT traversal procedure after handoff. Experimental results confirm that WANTS reduces not only connectivity check delay but also protocol messages as compared to the Interactivity Connectivity Establishment (ICE), which is the most acknowledged approach to creating a session across NATs.

Symmetric NAT Traversal Method for Session Initial Protocol (SIP)

Although the integration of SIP-based systems with a network address translation (NAT) environment has been investigated extensively, SIP-based system operation in symmetric model NAT remains relatively unexplored. This paper studies the application of symmetric NAT traversal techniques to SIP-based systems. This study focuses on following the SIP process, a non-additive service server, and employs standard SIP commands such as “REGISTER,” “INVITE,” and “200 OK” to predict and deliver the IP addresses and port numbers of the local NAT. This study also implements RTP streaming in the client-to-client (C2C) mode. The symmetric NAT traversal method for the SIP increases the direct peer-to-peer connection rate. This approach also avoids the STUN and RTP-Relay server. Experimental results with 50 types of NAT indicate that symmetric NAT traversal performs better than the STUN solution. The RTP-Relay server bandwidth cost is likewise superior to the TURN solution. These finding have important implications for SIP-based system developers and carrier providers.

Can: A context-aware NAT traversal scheme

Network Address Translation (NAT) is a technique commonly used to share one public IPv4 address among several hosts located behind a NAT device. NAT devices typically block session requests originating from outside, causing NAT traversal problem that prevents the establishment of peer-to-peer (P2P) sessions. There have been many proposals for the NAT traversal problem. However, existing methods induce high connectivity check delay and resource demand when finding a communicating path, calling for a routine that determines the path best suited for a given pair of communicating peers. This study proposes CAN, a Context-Aware NAT traversal scheme which gathers and exchanges network-context information to find the most appropriate path for two communicating peers behind NAT devices. We have implemented CAN and conducted extensive experiments with off-the-shelf NAT devices to compare the performance of CAN with Interactivity Connectivity Establishment (ICE), the most acknowledged approach to creating a session across NATs. Experimental results show that CAN outperforms ICE in terms of direct communication ratio, connectivity check delay and message overload when checking connectivity.

A Malicious Bot Capturing System using a Beneficial Bot and Wiki

Locating malicious bots in a large network is problematic because the internal firewalls and network ad- dress translation (NAT) routers of the network unintentionally contribute to hiding the bots' host address and malicious packets. However, eliminating firewalls and NAT routers merely for locating bots is generally not acceptable. In the present paper, we propose an easy to deploy, easy to manage network security control system for locating a malicious host behind internal secure gateways. The proposed network security control system consists of a remote security device and a command server. The remote security device is installed as a transparent link (implemented as an L2 switch), between the subnet and its gateway in order to detect a host that has been compromised by a malicious bot in a target subnet, while minimizing the impact of deployment. The security device is controlled remotely by 'polling' the command server in order to eliminate the NAT traversal problem and to be firewall friendly. Since the remote security device exists in transparent, remotely controlled, robust security gateways, we regard this device as a beneficial bot. We adopt a web server with wiki software as the command server in order to take advantage of its power of customization, ease of use, and ease of deployment of the server.

Automatic Service Discovery of IP Cameras over Wide Area Networks with NAT Traversal

A novel framework for remote service discovery and access of IP cameras with Network address Translation (NAT) traversal is presented in this paper. The proposed protocol, termed STDP (Service Trader Discovery Protocol), is a hybrid combination of Zeroconf and SIP (Session Initial Protocol). The Zeroconf is adopted for the discovery and/or publication of local services; whereas, the SIP is used for the delivery of local services to the remote nodes. In addition, both the SIP-ALG (Application Layer Gateway) and UPnP (Universal Plug and Play)-IGD (Internet Gateway Device) protocols are used for NAT traversal. The proposed framework is well-suited for high mobility applications where the fast deployment and low administration efforts of IP cameras are desired.

NAT Traversal and Detection on Dual Stack Implementation of Mobile IPv6

IPv4 private networks are behind NAT devices. So, to bypass the Binding Update and Binding Acknowledgment by NAT, we need to encapsulate it in UDP packets. So, the dual stack mobile IPv6 should support NAT traversal and Detection. Dual Stack Mobile IPv6 (DSMIPv6) is an extension of MIPv6 to support mobility of devices irrespective of IPv4 and IPv6 network. Current IP networks are predominantly based on IPv4 technology, and hence various firewalls as well as Network Address Translators (NATs) have been originally designed for these networks. Deployment of IPv6 networks is currently work in progress. This research provides an overview of network address translation (NAT) and its detection and traversal on dual stack implementation on Mobile IPv6. In DSMIPv6 the MIP6D daemon should bypass NAT, when Mobile Node is behind NAT device in IPv4 Foreign Link. General Terms Networks

Optimizing BitTorrent-like peer-to-peer systems in the presence of network address translation devices

BitTorrent nowadays is one of the most important peer-to-peer (P2P) file-sharing applications on the Internet, and it has also inspired many other P2P applications such as live or on-demand video streaming services. On the other hand, Network Address Translation (NAT) has become pervasive in almost all networking scenarios, from residential Internet access to enterprise networks. Despite the effort of NAT traversal, it is still very likely that P2P applications cannot receive incoming connection requests properly if they are behind NAT. To quantify the performance impact of NAT on BitTorrent-like P2P systems, we have created and validated a detailed but tractable mathematical model. We have also proposed and briefly examined a simple but effective strategy to mitigate the negative impact on NAT peers. In this paper, we further extend our model to cover the proposed biased optimistic unchoke strategy, and optimize the system performance in terms of both average peer download time and system finish time. We also create a new, faster Java-based BitTorrent simulator, which is used to validate the extended model and show the optimality of the proposed strategy and its boundary conditions.

A Survey of NAT Behavior Discovery in VoIP Applications

Because of the foreseeing depletion of Internet Protocol (IP) addresses, Network Address Translation (NAT) is ubiquitously deployed to allow hosts to connect to the Internet through a single shared public IP address, which is a popular approach in deploying wireless local area network (WLAN). Although NAT proves to work well with traditional client/server applications, its existence and non-standard behaviors are the major problem which cripples voice over IP (VoIP) applications. In addition to some efforts which attempt to devise complicated protocols to tackle all NAT varieties, there are also efforts in Internet communities trying to standardize the behaviors of NAT. Therefore, it becomes crucial for a network device to discover the existence of NAT in its subnet and to determine the NAT behaviors, so that it can choose the optimal NAT traversal mechanisms to apply. In this paper, we surveyed the divergent NAT behaviors and then proposed a simplified NAT behavior discovery approach which is more suitable for VoIP applications. The proposed approach can reduce the call establishment time of VoIP applications, which is useful in scenarios where VoIP devices are administrated within a specific domain, e.g., 3G cellular networks.

A collaborative P2P scheme for NAT Traversal Server discovery based on topological information

In the current Internet picture more than 70% of the hosts are located behind Network Address Translators (NATs). This is not a problem for the client/server paradigm. However, the Internet has evolved, and nowadays the largest portion of the traffic is due to peer-to-peer (p2p) applications. This scenario presents an important challenge: two hosts behind NATs (NATed hosts) cannot establish direct communications. The easiest way to solve this problem is by using a third entity, called Relay, that forwards the traffic between the NATed hosts. Although many efforts have been devoted to avoid the use of Relays, they are still needed in many situations. Hence, the selection of a suitable Relay becomes critical to many p2p applications. In this paper, we propose the Gradual Proximity Algorithm (GPA): a simple algorithm that guarantees the selection of a topologically close-by Relay. We present a measurement-based analysis, showing that the GPA minimizes both the delay of the relayed communication and the transit traffic generated by the Relay, being a QoS-aware and ISP-friendly solution. Furthermore, the paper presents the Peer-to-Peer NAT Traversal Architecture (P2P-NTA), which is a global, distributed and collaborative solution, based on the GPA. This architecture addresses the Relay discovery/selection problem. We have performed large-scale simulations based on real measurements, which validate our proposal. The results demonstrate that the P2P-NTA performs similarly to direct communications with reasonably large deployments of p2p applications. In fact, only 5% of the communications experience an extra delay that may degrade the QoS due to the use of Relays. Furthermore, the amount of extra transit traffic generated is only 6%. We also show that the P2P-NTA largely outperforms other proposals, where the QoS degradation affects up to more than 50% of the communications, and the extra traffic generated goes beyond 80%.

IP2P: a peer-to-peer system for mobile devices

Peer-to-peer communications is a major trend in wireless Internet. In a P2P system, the calling peer must identify the network address of the called peer before establishing a P2P connection. This article proposes iP2P, a hybrid P2P system for mobile devices. iP2P utilizes the short message service as the control protocol to identify the address of the called peer. Our approach provides an efficient identification mechanism without the requirement for the maintenance of a centralized registrar server in a hybrid P2P system. We also show how iP2P can integrate effectively with the existing network address translation traversal mechanisms to solve the private IP address issue.

Behavior and classification of NAT devices and implications for NAT traversal

For a long time, traditional client-server communication was the predominant communication paradigm of the Internet. Network address translation devices emerged to help with the limited availability of IP addresses and were designed with the hypothesis of asymmetric connection establishment in mind. But with the growing success of peer-to-peer applications, this assumption is no longer true. Consequently network address translation traversal became a field of intensive research and standardization for enabling efficient operation of new services. This article provides a comprehensive overview of NAT and introduces established NAT traversal techniques. A new categorization of applications into four NAT traversal service categories helps to determine applicable techniques for NAT traversal. The interactive connectivity establishment framework is categorized, and a new framework is introduced that addresses scenarios that are not supported by ICE. Current results from a field test on NAT behavior and the success ratio of NAT traversal techniques support the feasibility of this classification.