One document matched: draft-matthews-p2psip-nats-and-overlays-01.txt

Differences from draft-matthews-p2psip-nats-and-overlays-00.txt


P2PSIP WG                                                     E. Cooper 
Internet Draft                                              P. Matthews 
Intended status: Informational                                    Avaya 
Expires: September 2007                                   March 4, 2007 
                                    
 
             The Effect of NATs on P2PSIP Overlay Architecture 
              draft-matthews-p2psip-nats-and-overlays-01.txt 


Status of this Memo 

   By submitting this Internet-Draft, each author represents that       
   any applicable patent or other IPR claims of which he or she is       
   aware have been or will be disclosed, and any of which he or she       
   becomes aware will be disclosed, in accordance with Section 6 of       
   BCP 79. 

   Internet-Drafts are working documents of the Internet Engineering 
   Task Force (IETF), its areas, and its working groups.  Note that 
   other groups may also distribute working documents as Internet-
   Drafts. 

   Internet-Drafts are draft documents valid for a maximum of six months 
   and may be updated, replaced, or obsoleted by other documents at any 
   time.  It is inappropriate to use Internet-Drafts as reference 
   material or to cite them other than as "work in progress." 

   The list of current Internet-Drafts can be accessed at 
        http://www.ietf.org/ietf/1id-abstracts.txt 

   The list of Internet-Draft Shadow Directories can be accessed at 
        http://www.ietf.org/shadow.html 

   This Internet-Draft will expire on August 4, 2007. 

Copyright Notice 

   Copyright (C) The IETF Trust (2007). 

Abstract 

   This paper explains the problems created by Network Address 
   Translators (NATs) in Peer-to-Peer (P2P) overlays and recommends some 
   NAT traversal techniques appropriate for P2PSIP networks. Two P2PSIP 
   overlay architectures that accommodate the presence of NATs are 
   described and analyzed. The first is the super-peer scheme used in a 

 
 
 
Cooper & Matthews     Expires September 4, 2007                [Page 1] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   number of p2p file-sharing systems today. The second is a scheme 
   where all peers play an equal role in the overlay.  

Table of Contents 

   1. Introduction...................................................2 
   2. IP Network Structure...........................................3 
      2.1. NAT-Induced Problems in Overlay Networks..................4 
      2.2. NAT Traversal Techniques for P2PSIP Overlays..............5 
   3. Super-Peer Overlay Networks....................................6 
      3.1. NAT-Induced Problems in P2PSIP Super-Peer Overlays........6 
   4. Fully-Distributed Overlay Networks.............................7 
         4.1.1. Aligning the Search and Routing Structures...........8 
         4.1.2. NAT-Induced Problems in Fully-Distributed Overlays..11 
   5. Comparing Super-Peer and Fully-Distributed Overlay Networks...11 
   6. Other Hierarchical Overlay Network Topologies.................11 
      6.1. Modified Super-Peer Overlays.............................11 
      6.2. Representative Overlays..................................12 
   7. Conclusions...................................................13 
   8. Security Considerations.......................................14 
   9. IANA Considerations...........................................14 
   10. Acknowledgments..............................................14 
   APPENDIX A: Other NAT Traversal Techniques.......................15 
   11. References...................................................16 
      11.1. Normative References....................................16 
      11.2. Informative References..................................16 
   Author's Addresses...............................................18 
   Full Copyright Statement.........................................18 
   Intellectual Property............................................19 
   Acknowledgment...................................................19 
    
1. Introduction 

   P2P overlay networks have emerged as a popular, scalable and 
   efficient mechanism for sharing music and video files amongst 
   millions of computers. Early P2P file-sharing systems used a 
   combination of highly distributed content storage and a centralized 
   index of the available content to provide easy access to vast amounts 
   of data. Napster was one such system. Due to the legal implications 
   of its unauthorized content distribution, Napster was ordered to 
   cease operations. As soon as the centralized content index was 
   disabled, the Napster network was effectively shut down.  

   Of course, Napster's demise did nothing to squelch the demand for 
   easy access to vast amounts of content. New P2P file-sharing systems 
   emerged to replace Napster and all of them were designed without a 
   centralized content index. Various schemes were used to locate 
 
 
Cooper & Matthews     Expires September 4, 2007                [Page 2] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   content in these new networks. Some transmitted content queries 
   randomly amongst nodes, while others would flood the queries 
   throughout the network. Neither of these techniques was particularly 
   effective or efficient at locating content. Then P2P overlays adopted 
   a distributed hash table (DHT) approach for indexing their content. 
   As their name suggests, DHTs distribute the content index across many 
   nodes. DHTs do provide an effective and relatively efficient indexing 
   mechanism. The drawback is that as a result of this distribution, a 
   query into a DHT must be processed by a number of nodes before the 
   result can be determined.   

   As a result of their evolution, current P2P file-sharing overlays use 
   both distributed content storage and distributed context indexing. By 
   eliminating all centralization in the system, these P2P overlays have 
   gained a number of interesting benefits. They are self-organizing, 
   highly scalable, highly reliable and require very little 
   administration. 

   From a structural perspective, today's SIP networks have a lot in 
   common with the Napster file-sharing network. The 'content' in a SIP 
   system is the real-time data that flows directly between the nodes. 
   Although it doesn't need to be stored anywhere, the source addresses 
   of the 'content' must be collected into an index that can be easily 
   accessed. This index is analogous to the contact binding information 
   that is stored by Registrars. Of course, SIP networks do not face the 
   same legal difficulties as P2P file-sharing systems. They do, 
   however, have scalability, reliability and administrative concerns.  

   The P2PSIP working group is investigating how P2P techniques might be 
   used in conjunction with (or as an alternative to) the DNS-based 
   lookup and routing mechanisms of [RFC3261] and [RFC3263]. This paper 
   explores the problems introduced by the presence of NATs in the 
   network topology and discusses their effects on the P2PSIP overlay 
   architecture. 

   Comments on this draft are solicited and should be addressed either 
   to the authors or to the P2P-SIP mailing list at p2psip@ietf.org (see 
   https://www1.ietf.org/mailman/listinfo/p2psip). 

2. IP Network Structure 

   Overlay networks create a set of virtual links on top of the routes 
   of the underlying IP network. These virtual links are usually 
   structured to optimize the overlay for a particular purpose, such as 
   content indexing. 


 
 
Cooper & Matthews     Expires September 4, 2007                [Page 3] 

Internet-Draft            NATs and Overlays                  March 2007 
    

            ,-------. 
          ,' P    P  `. Subnet 1                    ,-----. Subnet 2 
         (          P  )                           (   P   ) 
          `. P   P   ,'                             `-----' 
            `-------'                            NAT 
                     NAT 
                               _.------------. 
                          ,--''               `---. 
                       ,-'                         `-. 
                      /                               \ 
                     /                                 \ 
                    (            Internet               ) 
                     \                                 / 
                      \                               / 
                       `-.                         ,-' 
                          `---.               _.--' 
             N A T             `------------'' 
         ,-.     ,-.                                ,-----. 
        / P \   ( P ) Subnet 4                    ,'  P    `. Subnet 5 
       ( P   )   `-'                             (   P   P   ) 
        \  P/                                     `.    P  ,' 
         `-' Subnet 3                               `-----' 
    
       Legend 
       P   - Peer node 
       NAT - NAT box 
    
                   Figure 1 Example IP Network Topology 

   Figure 1 shows a set of peers (denoted by Ps) that want to create an 
   overlay on top of an IP network. In this figure we see six clouds. 
   Five represent IP subnets containing peers and one represents the 
   Internet. One of the subnets uses public IP addresses, while the 
   other subnets have NATs between them and the Internet and thus use 
   private addresses. Two of the subnets are sitting behind the same 
   NAT. More complex network topologies are not depicted, but it would 
   not be uncommon for an overlay network to include peers that were 
   separated from the Internet by two or more NATs. 

2.1. NAT-Induced Problems in Overlay Networks 

   Some P2P overlays assume that all participating nodes are linked by 
   unimpeded IP connectivity. Unfortunately, the use of NATs is very 
   common, which means that a great many IP networks span multiple 
   addressing spaces.  


 
 
Cooper & Matthews     Expires September 4, 2007                [Page 4] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   Straightforward deployment of P2P overlays on IP networks involving 
   NATs would cause the overlay's mechanisms to fail because:  

      . The private IP addresses of some peers would be considered un-
        deliverable by the routers in the public Internet. This would 
        cause messages to be discarded. 

      . The IP addresses of some peers could conflict if the overlay 
        included multiple private address spaces. This would cause 
        messages to be delivered to the wrong peer. 

      . NATs perform mapping and filtering functions at the borders 
        between two addressing realms, and will frequently discard 
        packets they consider "unsolicited". From a NAT's perspective, 
        a message must be sent from a peer on its "private" side to a 
        peer on its "public" side before a message can travel in the 
        opposite direction.  

   All these mis-directed and dropped messages will cause overlay 
   services to fail and may prevent the participating peers from 
   constructing or maintaining overlay correctly. 

2.2. NAT Traversal Techniques for P2PSIP Overlays 

   NAT traversal is a well-known problem for SIP networks and much 
   effort has been devoted to solving it. [p2p-comm] discusses some 
   popular mechanisms for P2P systems and recommends a combination of 
   "NAT hole-punching" and "relay" techniques to establish 
   communications between peers in NATed networks.  

   Based upon the arguments for an UNSAF approach presented in [nat-
   consider], [ice] defines a mechanism for employing these two 
   techniques in SIP networks to route media streams between two NATed 
   endpoints. The use of ICE and other SIP NAT traversal techniques, 
   such as "symmetric signaling response" and "connection re-use", is 
   encouraged by [nat-scenarios]. 

   Since NATs create similar (and perhaps more severe) problems for 
   P2PSIP overlays, all of these mechanisms will need to be adopted for 
   P2PSIP overlay signaling protocols. Other SIP techniques, such as 
   [outbound], may also prove useful for P2PSIP systems. 

   The applicability of some other NAT traversal techniques is discussed 
   in APPENDIX A:  



 
 
Cooper & Matthews     Expires September 4, 2007                [Page 5] 

Internet-Draft            NATs and Overlays                  March 2007 
    

3. Super-Peer Overlay Networks 

   One way to organize a P2P overlay is to create an overlay topology in 
   which the publicly addressable peers (dubbed "super-peers") act as 
   relay points for the NATed peers. This structure essentially creates 
   a hierarchy in the overlay network. The super-peers (at the top 
   level) supply the content indexing function and provide message 
   routing to/from NATed peers. NATed peers are at a lower level. They 
   may advertise their content and query for content via their 
   associated super-peer, but do not process any queries or store any of 
   the content index data. 

                        __,,.O.,------------.....__  
                   ,,-''    Super-Peer            `'--..  
                 ''                           Super-Peer`O  
                `O Super-Peer                           / NAT  
                  `.._    Super-Peer                __.-'   \  
                      `'--O....._    Super-Peer.---''        \  
                         NAT     `----------O-''              O  
                          /\               NAT             NATed Peer  
                         /  \               /\  
                        O    O NATed Peers O  O 
    
                   Figure 2 P2P Overlay with Super-Peers 

3.1. NAT-Induced Problems in P2PSIP Super-Peer Overlays 

   The super-peer overlay network organization provides a simple and 
   efficient model for NAT traversal in P2PSIP networks. Its routing 
   structure has the advantage that a message sent from one peer to 
   another traverses at most 3 hops. 

   The main drawback of this approach is that it requires a sufficient 
   number of publicly addressable nodes to act as super-peers. In 
   addition, the super-peers must bear the entire load associated with 
   message routing. 

   Several P2PSIP use case scenarios are described in [use-cases]. 
   Referring back to Figure 1, one example of a P2PSIP "Managed Private 
   Network" scenario could include peers from subnets 1-4, but no peers 
   with public addresses. In such a network, a super-peer routing 
   topology is simply not possible. 

   Other use cases, including the "Public P2P VoIP Service Providers" 
   and "Open Global P2P VoIP Network" scenarios do include peers from 
   all five subnets. These overlay networks will have some percentage of 
   publicly addressable peers. One measurement has found that 74% of 
 
 
Cooper & Matthews     Expires September 4, 2007                [Page 6] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   web-browsing clients are behind NATs [illuminati]. If a similar 
   percentage of P2PSIP peers are NATed, a super-peer overlay topology 
   will be able to utilize only 1/4 of the resources available. 

   The bandwidth available at the super-peers is of particular concern. 
   Since every message in the overlay must traverse the IP links to the 
   super-peers, it's possible that super-peers with low-bandwidth links 
   will be overwhelmed, while high-bandwidth links to NATed peers will 
   be almost completely unused. 

   Further, the use of a super-peer routing structure requires that each 
   NATed peer must establish a long-lived association to a super-peer. 
   [behave-udp] and [behave-tcp] require the use of periodic "keep-
   alive" traffic to ensure connectivity across the intervening NAT. It 
   follows that the amount of keep-alive traffic arriving at a given 
   super-peer will be proportional to the number of NATed peers it 
   serves. Thus, in super-peer overlays, it is important to assign NATed 
   peers to super-peers such that only a reasonably small fraction of 
   the super-peer's bandwidth is consumed by keep-alive traffic. In 
   other words, the routing structure should be constructed such that 
   the super-peer's bandwidth is not overwhelmed. A mechanism for 
   distributing the load across super-peers will need to be created. 

   Another consequence of the super-peer routing structure is that the 
   amount of keep-alive traffic crossing a given NAT will be 
   proportional to the number of peers behind that NAT (regardless of 
   how those peers are distributed across super-peers). 

   Due to its connectionless nature, the bandwidth considerations are 
   considerably more pronounced for UDP than for TCP. However, TCP 
   connections require more state information to be maintained at the 
   super-peer. Both protocols require state information to be maintained 
   at the NAT. 

4. Fully Distributed Overlay Networks 

   As an alternative to the hierarchy created by super-peer overlays, it 
   is also possible to use the techniques of section 2.2. to create a 
   completely flat overlay network in which all peers are equal 
   participants. Such fully-distributed overlays also avoid the problems 
   created by NATs in the search algorithm (discussed in section 2.1. 
   and the problems in the super-peer routing topology (discussed in 
   section 3.1.   

   This approach does not place special emphasis on nodes with publicly 
   reachable addresses and can be deployed over any IP network topology. 

 
 
Cooper & Matthews     Expires September 4, 2007                [Page 7] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   Since all peers participate in the search scheme and in message 
   routing, all of the available resources can be utilized. 

   [dSIP-nat] is one example of a fully distributed overlay that uses 
   SIP-based messaging to implement a DHT search algorithm. Fully 
   distributed P2PSIP overlay networks could also be built using other 
   protocols and/or other search algorithms. 

4.1.1. Aligning the Search and Routing Structures 

   Many DHTs route queries amongst peers such that any query can reach 
   the appropriate (authoritative for that query) peer in O(log N) hops. 
   As previously mentioned, the problem is that these searching 
   structures do not account for impediments in IP routing. Creating a 
   routing structure that mirrors the search algorithm will preserve the 
   efficiency of the search algorithm as much as possible. 

   To determine the specifics of the routing structure, we examine the 
   search algorithm in a bit more detail. Chord is used as an example. 
   To process queries, peers participating in a chord overlay maintain 
   tables of other peers that will assist in routing queries to their 
   destinations.  These tables form a good starting point for the 
   routing topology. 

   In Chord, some unique peer attribute is hashed using SHA-1 and the 
   result (called a peer identifier) is used to place peers on a 
   conceptual ring. Each peer then maintains connections to peers 
   located at exponentially increasing locations going clockwise around 
   the ring.  For example, a peer P, with ID 0 might have a table 
   consisting of addresses for peers with IDs 2^0, 2^1, 2^2,..., 2^(n/2) 
   (where n=# of output bits for SHA-1).  

   In this routing structure, a message to peer Q can be addressed to 
   Q's location in the ring, and any intermediate peer R can forward the 
   message by selecting the peer from its connection table that is that 
   is closest to Q without overshooting Q.  

   Many other connection structures exist. For example, structured 
   routing topologies can be created using the ideas contained in any 
   one of a number of DHT schemes. The important point is that the 
   structure of the routing topology matches the message flow required 
   by the search algorithm. 

4.1.1.1. Symmetric Interest 

   When considering connection topologies, there is a property we have 
   dubbed "symmetric interest". A connection structure exhibits 
 
 
Cooper & Matthews     Expires September 4, 2007                [Page 8] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   "symmetric interest" if, when peer P desires a connection to peer Q, 
   then peer Q also desires a connection to peer P.  

   A routing structure based on peers randomly selecting other peers to 
   connect to does NOT exhibit symmetric interest because peer P can 
   select peer Q without peer Q selecting peer P. Similarly, a Chord-
   based connection structure (depicted in Figure 3) also does NOT 
   exhibit symmetric interest because a given peer P in the ring desires 
   connections to peers in the clockwise half-circle but not in the 
   counter-clockwise half-circle.  

                                     O    
                                O    |    O  
                           O         |        O  
                                     |             
                        O            |           O  
                                     |              
                                     |                
                       O------       |             O  
                              \      |                
                               \     |                
                        O       \    |            O   
                                 \   |              
                          O-------\  |          O  
                                   \ |           
                               O----\|    O  
                                     O    Peer Q  
                                   Peer P 
    
                Figure 3 Chord-based Connection Structure 1 

   Figure 3 depicts a connection topology from the perspective of a 
   single peer P. As described in section 4.1.1.  if P's ID were 0, it 
   might have a table consisting of addresses for peers with IDs 2^0, 
   2^1, 2^2,..., 2^(n/2). Peer P would never include Peer Q in its 
   connection table, since Q's ID is greater 2^(n/2).  However, Peer Q's 
   connection table may include Peer P, since P's ID is contained in the 
   clockwise half-circle starting at Q's ID. Figure 4 illustrates the 
   same connection topology from the perspective of Peer Q.  








 
 
Cooper & Matthews     Expires September 4, 2007                [Page 9] 

Internet-Draft            NATs and Overlays                  March 2007 
    

                                     O   
                             O             O  
                              \        
                               \         
                        O       \                O  
                                 \                  
                                  \                   
                       O           \               O  
                          /---------\                 
                         /           \                
                        O             \           O   
                                       \            
                          O       /-----\       O  
                                 /       \       
                                O     /---O  
                                     O    Peer Q  
                                   Peer P 
    
                Figure 4 Chord-based Connection Structure 2 

   One topology that does exhibit symmetric interest has each peer 
   maintaining connections to peers located an exponentially increasing 
   distances going both clockwise AND counter-clockwise around the ring.  

                                     O  
                                O    |    O  
                           O         |        O  
                                     |             
                        O            |           O  
                                     |              
                                     |                
                       O------       |       ------O  
                              \      |      /         
                               \     |     /           
                        O       \    |    /       O   
                                 \   |   /           
                          O-------\  |  /--------O  
                                   \ | /          
                               O----\|/----O  
                                     O    Peer Q  
                                   Peer P 
    
                      Figure 5 Symmetric Partial Mesh 

   "Symmetric interest" seems a desirable property for routing 
   topologies because connections through NATs, by their nature, are bi-

 
 
Cooper & Matthews     Expires September 4, 2007               [Page 10] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   directional and because both peers incur the overhead of sending 
   keep-alives to maintain the connection.  

4.1.2. NAT-Induced Problems in Fully Distributed Overlays 

   As mentioned in section 3.1.  each routing connection that crosses a 
   NAT must be maintained by P2PSIP peers. This applies to the fully 
   distributed overlay network too. 

   There is a possibility that the number of viable connections in a 
   peer's table might be constrained by the number of 'pinhole' mapping 
   and filtering entries that can be supported by a peer's local NAT. 
   Unfortunately, NAT behaviour is notoriously variable, so it is 
   difficult to predict the achievable size for a peer's connection 
   table. If the number of entries in this table is reduced below the 
   DHT's prescribed size, the message routing efficiency may be reduced, 
   or fail completely. For example, under a Chord-based routing 
   topology, the connection to the peer's immediate successor is 
   critically important. Without that link, messages may fail to reach 
   their destination. The other connections in a Chord-based structure 
   are used to improve routing efficiency, but some may be removed 
   without jeopardizing routing correctness. 

   So in a fully distributed overlay, peers may need to reduce the size 
   of their connection tables to accommodate limitations in their local 
   NATs. This can reduce the search algorithm's efficiency. 

   Interestingly, when large numbers of peers are operating behind the 
   same NAT, DHT-based search algorithms is likely to create many 
   connections that do not need to cross the NAT. 

5. Comparing Super-Peer and Fully Distributed Overlay Networks 

     << [concepts] describes three modes of operation under which P2PSIP 
     peers can register and make calls. These modes are variations on 
     how user contact information in stored, retrieved and used by peers 
     in the overlay network. A future version of this paper will compare 
     the performance of the super-peer and fully distributed overlays 
     under each mode. >> 

6. Other Hierarchical Overlay Network Topologies 

6.1. Modified Super-Peer Overlays 

   As discussed in section 3.1. super-peer routing topologies can 
   encounter difficulties when many peers are behind the same NAT. The 
   resources (bandwidth, state-information) required for NAT traversal 
 
 
Cooper & Matthews     Expires September 4, 2007               [Page 11] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   could be reduced if a single "Representative" peer were elected to 
   proxy all the traffic between the NATed peers and the super-peer. An 
   overlay utilizing both super-peers and representatives is depicted in 
   Figure 6. 

                     __,,.O.,------------.....__ 
                ,,-''    Super-Peer            `'--.. 
              ''                           Super-Peer`O 
             `O Super-Peer                           / NAT 
               `.._    Super-Peer                __.-'   \ 
                   `'--O...._     Super-Peer.---''        \ 
                      NAT    `-----------O-''              O 
                       |                NAT         Representative Peer 
                       |                 | 
                       O Representatives O 
                      / \               / \ 
                     O   O NATed Peers O   O 
    
       Figure 6 Overlay Network with Super-Peers and Representatives 

   The network shown in Figure 6 minimizes the amount of effort that 
   needs to be expended for NAT pinhole maintenance, but introduces 
   another level of hierarchy into the overlay and thus increases 
   message hop counts. Further, it requires some new mechanism to allow 
   NATed peers to discover each other and elect a representative.  

   In this topology, both the super-peer and the representative are 
   assumed to be servicing large numbers of NATed peers, so their 
   performance and availability are a concern. 

6.2. Representative Overlays 

   It's worth noting that the super-peer and representative concepts are 
   independent of each other. It is possible to construct an overlay 
   network in which representative peers (residing behind NATs) use ICE 
   NAT traversal techniques to create connections to other peers in the 
   overlay. No super-peers (publicly addressable peers) need be present 
   in such a network.  

   This is a similar type of hierarchy to the super-peer hierarchy in 
   that representative peers connected in such a way would have overlay 
   IDs and implement the search algorithm and NATed peers would not. 
   This type of overlay topology would increase the number of 
   connections crossing the NAT above the bare minimum required in 
   Figure 6, but instead of being proportional to the number of super-
   peers serving nodes behind a NAT, it would instead be related to the 
   number of connections the representative had to other peers. 
 
 
Cooper & Matthews     Expires September 4, 2007               [Page 12] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   As with the super-peer overlay, representatives are assumed to be 
   serving large numbers of NATed peers, so performance and availability 
   are concerns. 

   Introducing hierarchy into an overlay network, either through super-
   peers or representatives, is a relatively effective NAT traversal 
   technique. However, it requires that super-peers and/or 
   representatives must perform two distinct routing operations: one to 
   direct search queries to other super-peers and another one to allow 
   NATed peers to access the overlay. 

   The inclusion of a hierarchy also requires the creation of new 
   techniques to distribute the load appropriately and recover from 
   failures. These mechanisms are generally independent from similar 
   mechanisms already present in search algorithms like DHTs. 

7. Conclusions 

   The presence of NATs in IP networks present several challenges for 
   P2PSIP overlays. A super-peer overlay architecture is easy-to-
   understand and provides effective NAT traversal. However, it 
   concentrates the network load on a small percentage of the 
   participating nodes and cannot be used in networks that have no 
   publicly addressable peers. 

   Fully distributed overlays traverse NATs equally well and share the 
   load evenly across participating peers, which results in greater 
   performance and scalability. Since they do not require any nodes to 
   have public IP addresses, these architectures can be applied to more 
   IP network topologies.  

   Fully distributed networks implicitly determine (based upon their 
   search algorithm) how many connections will cross a peer's local NAT. 
   Depending on the search algorithm, it may be possible to adjust the 
   number of connections so no single NAT is overwhelmed by the keep-
   alive traffic or number of mappings it needs to maintain.  

   Super-peer overlays have no inherent mechanism for associating NATed 
   peers with super-peers, so one must be created. In creating this 
   mechanism special consideration must be given to the resources 
   available at both the super-peer and in the NAT. Due to their role as 
   routers for overlay messages, super-peers that serve many NATed peers 
   must be highly available and have high-bandwidth Internet links. 

   In fully distributed networks the connections required for message 
   routing are the same ones used by the search algorithm. Since the 
   routing topology in a super-peer overlay is separate from the 
 
 
Cooper & Matthews     Expires September 4, 2007               [Page 13] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   searching mechanism, a super-peer overlay will devote extra resources 
   to NAT traversal. 

8. Security Considerations 

   Security Considerations will be covered in a later version of this 
   paper.  

9. IANA Considerations 

   IANA considerations will be covered in a later version of this paper. 

10. Acknowledgments 

    
































 
 
Cooper & Matthews     Expires September 4, 2007               [Page 14] 

Internet-Draft            NATs and Overlays                  March 2007 
    

APPENDIX A: Other NAT Traversal Techniques 

   In addition to the techniques discussed in section 2.2. other 
   addition to those, some other mechanisms for NAT traversal are: UPnP, 
   ALGs, SBCs, and manual configuration.  

   Universal Plug-n-Play (UPnP) is a NAT configuration scheme developed 
   by Microsoft. This HTTP/XML based protocol allows applications to 
   dynamically create forwarding rules in the NAT as needed. Many 
   consumer-grade NATs support the UPnP protocol, which makes this seem 
   quite promising for P2P applications targeted only at the consumer 
   market. However, most corporate-grade NATs do not support UPnP. Even 
   in the consumer market space, the user would be required to provide 
   the administrative password for the NAT. Further, even if 
   administrative access to the NAT is possible, UPnP cannot provide a 
   complete solution if there are multiple NATs between the P2PSIP 
   device and the public Internet.   

   Many NATs contain one or more Application Level Gateways (ALGs). An 
   ALG is special code within the NAT that recognizes packets of a 
   particular application-level protocol and treats the packets 
   specially. ALG support for the File Transfer Protocol (FTP) is almost 
   universal in NATs, and ALG support for SIP is becoming more common. 
   However, ALG support requires that the application protocol not be 
   encrypted end-to-end, and end-to-end encryption of both SIP and P2P 
   messages is likely to be desirable for security reasons.  

   Session Border Controllers (SBCs) are boxes that are deployed in the 
   network, sometimes by the customer but more commonly by the SIP 
   service provider, to enable NAT traversal for standard client-server 
   SIP. SBCs are becoming more common, but typically sit on the border 
   of a "trusted" SIP service provider network and an "untrusted" 
   network (usually the public Internet). In a distributed network of 
   P2PSIP peers, there is no single boundary where an SBC would be 
   appropriate. Furthermore, SBCs are typically designed to work in 
   client-server deployments, and even then only with the SIP proxy 
   servers of a specific SIP service provider. Thus they are not well 
   suited as a NAT traversal option for P2PSIP networks.  

   NAT traversal is often much easier if the user can manually configure 
   the NAT. The user can open up pinholes in the NAT and/or modify the 
   NAT's behavior. However, this requires that the user have the 
   knowledge and interest to do the configuration (non-technical users 
   often do not), have a NAT that is configurable (some low-end NATs are 
   not configurable), and have permission to configure the NAT 
   (problematic in corporate environments or when there are NATs in the 
   ISP's network). Like UPnP, manual configuration cannot provide a 
 
 
Cooper & Matthews     Expires September 4, 2007               [Page 15] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   complete solution if there are multiple NATs between the P2PSIP 
   device and the public Internet. 

11. References 

11.1. Normative References 

    

11.2. Informative References 

   [RFC3261] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,            
             A., Peterson, J., Sparks, R., Handley, M., and E.           
             Schooler, "SIP: Session Initiation Protocol", RFC 3261, 
             http://www.ietf.org/rfc/rfc3261.txt, June 2002.    

   [RFC3263] Rosenberg, J., and Schulzrinne, H., "Session Initiation 
             Protocol (SIP): Locating SIP Servers", RFC 3263, 
             http://www.ietf.org/rfc/rfc3263.txt, June 2002.                     

   [p2p-comm] Ford, B., Srisuresh, P., and Kegel, D., "State of Peer-to-
             Peer (P2P) Communication Across Network Address Translators 
             (NATs)", draft-ietf-behave-p2p-state-02 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-ietf-behave-p2p-
             state-02.txt, February 2007. 

   [nat-consider] Rosenberg, J., "Considerations for Selection of 
             Techniques for NAT Traversal", draft-iab-nat-traversal-
             considerations-00 (expired), 
             http://tools.ietf.org/html/draft-iab-nat-traversal-
             considerations-00.  

   [ice] Rosenberg, J., "Interactive Connectivity Establishment (ICE): A 
             Methodology for Network Address Translator (NAT) Traversal 
             for Offer/Answer Protocols," draft-ietf-mmusic-ice-13 (work 
             in progress), http://www.ietf.org/internet-drafts/draft-
             ietf-mmusic-ice-13.txt. 

   [nat-scenarios] Boulton, C., Rosenberg, J. and Camarillo, G., "Best 
             Current Practices for NAT Traversal for SIP", draft-ietf-
             sipping-nat-scenarios-06 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-ietf-sipping-nat-
             scenarios-06.txt, March 2007. 




 
 
Cooper & Matthews     Expires September 4, 2007               [Page 16] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   [outbound] Jennings, C. and Mahy, R., "Managing Client Initiated 
             Connections in the Session Initiation Protocol (SIP)", 
             draft-ietf-sip-outbound-07 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-ietf-sip-
             outbound-07.txt, January 2007. 

   [chord] Stoica, I., Morris, R., Liben-Nowell, D., Karger, D., 
             Kaashoek, M., Dabek, F., and H. Balakrishnan, "Chord: A 
             Scalable Peer-to-peer Lookup Service for Internet 
             Applications" article(s) available at 
             http://pdos.csail.mit.edu/chord/pubs.html. 

   [use-cases] Bryan, D. A., Shim, E. and Lowekamp, B. B., "Use Cases 
             for Peer-to-Peer Session Initiation Protocol (P2P SIP)", 
             draft-bryan-sipping-p2p-usecases-00 (expired), 
             http://tools.ietf.org/id/draft-bryan-sipping-p2p-usecases-
             00.txt. 

   [illuminati] Cadaco, M. and Freedman, M., "Illuminati - Opportunistic 
             Network and Web Measurement", 
             http://illuminati.coralcdn.org/stats, February 2007.  

   [concepts] Bryan, D., Matthews, P., Shim, E. and Willis, D., 
             "Concepts and Terminology for Peer to Peer SIP", draft-
             willis-p2psip-concepts-03 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-willis-p2psip-
             concepts-04.txt, March 2007. 

   [behave-udp] Audet, F. and C. Jennings, "Network Address Translation 
             (NAT) Behavioral Requirements for Unicast UDP", 
             RFC4787/BCP127, http://www.ietf.org/rfc/rfc4787.txt, 
             January 2007. 

   [behave-tcp] Guha, S., Biswas, K., Ford, B., Sivakumar, S., and 
             Srisuresh, P., "NAT Behavioral Requirements for TCP", 
             draft-ietf-behave-tcp-05 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-ietf-behave-tcp-
             05.txt, February 2007. 

   [dSIP-nat] Cooper, E., Matthews, P., Bryan, D. and Lowekamp, B., "NAT 
             Traversal for dSIP", draft-matthews-p2psip-dsip-nat-
             traversal-00 (work in progress), 
             http://www.ietf.org/internet-drafts/draft-matthews-p2psip-
             dsip-nat-traversal-00.txt, February 2007. 



 
 
Cooper & Matthews     Expires September 4, 2007               [Page 17] 

Internet-Draft            NATs and Overlays                  March 2007 
    

   [stun] Rosenberg, J., Huitema, C., Mahy, R., and Wing, D., "Simple 
             Traversal Underneath Network Address Translators (NAT) 
             (STUN)", draft-ietf-behave-rfc3489bis-05 (work in 
             progress), http://www.ietf.org/internet-drafts/draft-ietf-
             behave-rfc3489bis-05.txt, October 2006. 

Author's Addresses 

   Eric Cooper 
   Avaya 
   1135 Innovation Dr. 
   Ottawa, Ontario K2K 3G7 
   Canada 
       
   Phone: +1 613 592 4343 x228 
   Email: ecooper@avaya.com 
    

   Philip Matthews 
   Avaya 
   1135 Innovation Dr. 
   Ottawa, Ontario K2K 3G7 
   Canada 
       
   Phone: +1 613 592 4343 x224 
   Email: philip_matthews@magma.ca 
    

Full Copyright Statement 

   Copyright (C) The IETF Trust (2007). 

   This document is subject to the rights, licenses and restrictions   
   contained in BCP 78, and except as set forth therein, the authors  
   retain all their rights. 

   This document and the information contained herein are provided on an   
   "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS 
   OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND 
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS 
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF 
   THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED 
   WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 




 
 
Cooper & Matthews     Expires September 4, 2007               [Page 18] 

Internet-Draft            NATs and Overlays                  March 2007 
    

Intellectual Property 

   The IETF takes no position regarding the validity or scope of any 
   Intellectual Property Rights or other rights that might be claimed to 
   pertain to the implementation or use of the technology described in 
   this document or the extent to which any license under such rights 
   might or might not be available; nor does it represent that it has 
   made any independent effort to identify any such rights.  Information 
   on the procedures with respect to rights in RFC documents can be 
   found in BCP 78 and BCP 79. 

   Copies of IPR disclosures made to the IETF Secretariat and any 
   assurances of licenses to be made available, or the result of an 
   attempt made to obtain a general license or permission for the use of 
   such proprietary rights by implementers or users of this 
   specification can be obtained from the IETF on-line IPR repository at 
   http://www.ietf.org/ipr. 

   The IETF invites any interested party to bring to its attention any 
   copyrights, patents or patent applications, or other proprietary 
   rights that may cover technology that may be required to implement 
   this standard.  Please address the information to the IETF at 
   ietf-ipr@ietf.org. 

Acknowledgment 

   Funding for the RFC Editor function is provided by the IETF 
   Administrative Support Activity (IASA). 

 

















 
 
Cooper & Matthews     Expires September 4, 2007               [Page 19] 


PAFTECH AB 2003-20262026-04-23 22:48:03