- NANOG - lists.nanog.org

RE: IPSEC and PAT
by Vandy Hamidi 14 Sep '01

14 Sep '01

It is working now. I've done it with Linksys and Netopia DSL routers. Software client on the laptop that DOES tunnel mode ESP. No AH and running through a PAT and it works flawlessly. I just want to know how it works, I've already determined that it does. The point where my logic fails is where PAT relies on modifying the TCP/UDP port numbers, an ESP packet has a standard IP header with an additional protocol 50 ESP header. Since there is no ports to change to create a table to keep track of which packet came from which internal client, what is used to keep track. Someone said something about the UDP encapsulation, but what about the NETOPIA which doesn't do that? -=Vandy=- -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Thursday, September 13, 2001 5:21 PM To: Vandy Hamidi Cc: nanog(a)merit.edu Subject: Re: IPSEC and PAT In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co m>, Vandy Hamidi writes: > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP >500 being used), but as I'm trying to break down the process of how it is >working, I've been stumped by this: >NAT - Changes source IP during translation >PAT - Changes source IP and TCP/UDP port to another to track multiple to one >translations. >My question is, how does PAT track the packets with their internal hosts >when there is not a TCP/UDP header to translate. >How does it know which "internal" host a returning ESP packet must be >forwarded to after it un PATs the incoming packet? >thanks and I hope this isn't a totally stupid question. If it is, humor me >;), IPsec can't be PATted, because the TCP and UDP port numbers are in the protected part of the packet. --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0

OT, but very high human factor
by Jason Legate 14 Sep '01

14 Sep '01

Just received this email: --- Light a Candle for Unity! Though terrorists may have struck out at us as Americans, let us come together and show our unity. Let us show that though our arm may have been hurt, they can not dim the heart of America which rages bright. On Thursday September 13, 2001 at 10:30 pm EST, walk out your door and light a candle or lantern to show the world that our spirit burns bright. Gather with loved ones or gather with neighbors but let our light burn in the night to show that we are united and that we remain strong. Please pass this on to anyone you know..print it up and pass it to neighbors who may not have internet access, post it to message boards, clubs, news stations, anywhere and everywhere there is a PROUD American! May we all be Blessed --- -j -- Jason Legate Sr. Net/Sys Admin, eVine, Inc. work- jlegate(a)evine.com | home- jlegate(a)alienchick.com Key Fingerprint: 4FB4 2228 DE63 3BBA 7B72 40DD 13D5 2547 821D 2909

1 0

Re: IPSEC and PAT
by Adam Herscher 14 Sep '01

14 Sep '01

FWIW, some VPN devices including Cisco's line of "Concentrators" (from the aquisition of Altiga), conquer this problem by encapsulating the IPSEC data in UDP. It's hackish, but is a good solution for VPNs to telcommuters behind hotel PAT and little Linksys dsl devices. According to our vendors, these Cisco devices are currently "special order" items, meaning they take a long time to stock. They're also relatively new, so open box/dying dotcom/ebay hardware is hard to come by. Regards- Adam On Thu, 13 Sep 2001, Steven M. Bellovin wrote: > > In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co > m>, Vandy Hamidi writes: > > > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP > >500 being used), but as I'm trying to break down the process of how it is > >working, I've been stumped by this: > >NAT - Changes source IP during translation > >PAT - Changes source IP and TCP/UDP port to another to track multiple to one > >translations. > >My question is, how does PAT track the packets with their internal hosts > >when there is not a TCP/UDP header to translate. > >How does it know which "internal" host a returning ESP packet must be > >forwarded to after it un PATs the incoming packet? > >thanks and I hope this isn't a totally stupid question. If it is, humor me > >;), > > IPsec can't be PATted, because the TCP and UDP port numbers are in the > protected part of the packet. > > --Steve Bellovin, http://www.research.att.com/~smb > http://www.wilyhacker.com > >

1 0

assistance available
by Paul A Vixie 14 Sep '01

14 Sep '01

PAIX and Abovenet (both subsidiaries of MFN) have space, power and various forms of connectivity available at 111 8th. Anyone who was impacted by the WTC disaster and who needs a place to set up an emergency network node should get in touch w/ me (I'll intro you to MFN or to Abovenet if PAIX can't help.)

6 6

Re: IPSEC and PAT
by Steven M. Bellovin 14 Sep '01

14 Sep '01

In message <912A91BC69F4D3119D1B009027D0D40C01BB459C(a)exchange1.secure.insweb.co m>, Vandy Hamidi writes: > >I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP >500 being used), but as I'm trying to break down the process of how it is >working, I've been stumped by this: >NAT - Changes source IP during translation >PAT - Changes source IP and TCP/UDP port to another to track multiple to one >translations. >My question is, how does PAT track the packets with their internal hosts >when there is not a TCP/UDP header to translate. >How does it know which "internal" host a returning ESP packet must be >forwarded to after it un PATs the incoming packet? >thanks and I hope this isn't a totally stupid question. If it is, humor me >;), IPsec can't be PATted, because the TCP and UDP port numbers are in the protected part of the packet. --Steve Bellovin, http://www.research.att.com/~smb http://www.wilyhacker.com

1 0

RE: Analysis from a JHU CS Prof
by Hire, Ejay 13 Sep '01

13 Sep '01

Most ATC towers do not have true radar. I.e. the ability to detect flying objects above altitude x by bouncing radio waves off of the object and computing the time vs. Doppler shift vs. inclination to determine altitude/heading/speed. In modern (non-military) atc systems, this info is relayed by the transponder to atc. Source: "How to become a Pilot" Bantnam Press. -----Original Message----- From: Leigh Anne Chisholm [mailto:lachisho@tnc.com] Sent: Thursday, September 13, 2001 5:11 PM To: Borger, Ben; nanog(a)merit.edu; Hire, Ejay Subject: RE: Analysis from a JHU CS Prof I despise posting off-topic, but I want to say two things... 1. If a transponder is turned off, it doesn't mean that you don't show up on radar--a blip appears on the radar screen as long as you're high enough to be detected. If however you fly low enough, you can fly below the radar's detection capability. I don't offhand recall what height that is--it's been years since I was active as a pilot and prospective Air Traffic Controller. 2. What's the point of having transponder codes for hijacking if they're so well published everyone is aware of them? The purpose of the codes was so that the pilot could communicate this information without the hijacker becoming aware of what was happening. I have always REALLY DISLIKED the now common practice of advertising this information. You're taking away one of the pilot's best tools... -- Leigh Anne > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Hire, Ejay > Sent: Thursday, September 13, 2001 2:35 PM > To: 'Borger, Ben'; 'nanog(a)merit.edu' > Subject: RE: Analysis from a JHU CS Prof > > > > The transponders, like most avionics, has a handy-dandy off switch. > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Borger, Ben > Sent: Thursday, September 13, 2001 2:32 PM > To: 'nanog(a)merit.edu' > Subject: FW: Analysis from a JHU CS Prof > > > > >>At 06:05 PM 9/12/2001, you wrote: > >> > >> > >>Quite more interesting is why nobody noticed that 4 airliners where > hijacked > >>almost the same time. > > > >Not surprising. Aircraft are "flight followed" by a series of control > >centers across the nation, each responsible for a given chunk of > >airspace. Something happening in an area controlled by Center "A", for > >example, wouldn't be passed on to Center "B" (which has it's own > problems > >to work) unless it impacted Center "B". Furthermore, unless > someone TELLS > >Center they're being hijacked, there's no way for a controller - > looking at > > >a blip - to know what's up. And any controller can tell you > that pilots do > > > Somehow the people who did this managed to turn off the transponders on > these planes. Normally a plane flying in controlled airspace squawks a > unique id and altitude which is decoded by their radar and associated with > each blip. Sometimes low cost homebuilts/ultralights fly with no > transponder, but Boeings <sarcasm>usually</sarcasm> do. If you set a > transponder to XXXXX, it means you're being hijacked. > > BTW if you see your friend Jack at the airport, be sure to say, > "What's up, > Jack!" instead of "Hi Jack!" > > So how do you deal with this? Blowing up a whole country? I > wonder if the > US should adopt a 'fire w/ fire' approach and invest in > intelligence, covert > ops and assassinations. It would seem that it is open season on terrorism > by every democratic nation, I expect to see very conspicuous > Samuel Jackson > style ass whoopins on whiny extremist groups to satiate America's anger. > Terrorize the terrorists. > > Oh yeah, obviously Echelon should probably have MacOS loaded on it. > > -b

4 3

IPSEC and PAT
by Vandy Hamidi 13 Sep '01

13 Sep '01

I know that in Tunnel Mode, IPsec can be NATed and PATed (without IKE on UDP 500 being used), but as I'm trying to break down the process of how it is working, I've been stumped by this: NAT - Changes source IP during translation PAT - Changes source IP and TCP/UDP port to another to track multiple to one translations. My question is, how does PAT track the packets with their internal hosts when there is not a TCP/UDP header to translate. How does it know which "internal" host a returning ESP packet must be forwarded to after it un PATs the incoming packet? thanks and I hope this isn't a totally stupid question. If it is, humor me ;), -=Vandy=-

1 0

FW: Analysis from a JHU CS Prof
by Borger, Ben 13 Sep '01

13 Sep '01

>>At 06:05 PM 9/12/2001, you wrote: >> >> >>Quite more interesting is why nobody noticed that 4 airliners where hijacked >>almost the same time. > >Not surprising. Aircraft are "flight followed" by a series of control >centers across the nation, each responsible for a given chunk of >airspace. Something happening in an area controlled by Center "A", for >example, wouldn't be passed on to Center "B" (which has it's own problems >to work) unless it impacted Center "B". Furthermore, unless someone TELLS >Center they're being hijacked, there's no way for a controller - looking at >a blip - to know what's up. And any controller can tell you that pilots do Somehow the people who did this managed to turn off the transponders on these planes. Normally a plane flying in controlled airspace squawks a unique id and altitude which is decoded by their radar and associated with each blip. Sometimes low cost homebuilts/ultralights fly with no transponder, but Boeings <sarcasm>usually</sarcasm> do. If you set a transponder to 7500, it means you're being hijacked. BTW if you see your friend Jack at the airport, be sure to say, "What's up, Jack!" instead of "Hi Jack!" So how do you deal with this? Blowing up a whole country? I wonder if the US should adopt a 'fire w/ fire' approach and invest in intelligence, covert ops and assassinations. It would seem that it is open season on terrorism by every democratic nation, I expect to see very conspicuous Samuel Jackson style ass whoopins on whiny extremist groups to satiate America's anger. Terrorize the terrorists. Oh yeah, obviously Echelon should probably have MacOS loaded on it. -b

9 8

$1M Reward for Bin Laden [OT]
by E.B. Dreger 13 Sep '01

13 Sep '01

Greetings all, Heard on a local radio station (102.9, call letters unknown by myself, identified as a Cumulus Broadcasting station) that they FBI has a $1M reward for Bin Laden. I don't know if they mean alive-only or dead-or-alive; the FBI's site appears to have no update on his profile since June, when they stated that they were offering up to $5M for his arrest and conviction. FWIW, they also stated that an ABC News Poll found 94% of Americans favored military retaliation, 86% even if it meant going to war. I'll try to stay on-topic now... Eddy --------------------------------------------------------------------------- Brotsman & Dreger, Inc. - EverQuick Internet Division Phone: +1 (316) 794-8922 Wichita/(Inter)national Phone: +1 (785) 865-5885 Lawrence --------------------------------------------------------------------------- Date: Mon, 21 May 2001 11:23:58 +0000 (GMT) From: A Trap <blacklist(a)brics.com> To: blacklist(a)brics.com Subject: Please ignore this portion of my mail signature. These last few lines are a trap for address-harvesting spambots. Do NOT send mail to <blacklist(a)brics.com>, or you are likely to be blocked.

1 0

volunteer available in NYC this weekend
by Matt Cramer 13 Sep '01

13 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- I'll be coming to NYC this weekend from PA and would like to offer my time to anyone affected by this tragedy. I am free all day sunday and can offer system administration (*NIX and Windoze), security, and networking help. Unfortunately I can not offer equipment. Feel free to contact me via email, and after friday night, at the cell phone number below. Matt - -- Matthew S. Cramer <mscramer(a)armstrong.com> Office: 717-396-5032 Lead Security Analyst Fax: 717-396-5590 Armstrong Information Technology Services Pager: 717-305-3915 Armstrong World Industries, Inc. Cell: 717-917-7099 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: ascii iQEVAwUBO6E/GQdAU78fakRxAQHC6gf/XrL2EbaqZ54ptGBLsj7Yif+LXEX9bel3 FJh+mth3oNqug9hKhvU1LCJINj9Jc8pilpovzvkPQLkllTR3liLaoi7K8LGirnwi EFIQMiMi3HeJ4Shkxr2WM190ITDEA8i7zXVXXqCKJ3LQ0zkxHRMfTSuFYg/yVyUS HGdP7JvdSCgptOyegfIHaPGblJeLU4wZy4MGDDHVgdxFCGFC1btgf4vic97u4xlU qVwBiEacfNIuJu8Zfu7YZGeNcCN469CZgMxp0Q/z9AGmILUpGASWC789Qc/aENGA RMZq/HFbdsxW8NL+U+tBeM1+WZ9ZdNiSkdInW3l4WiU4kvvUqx0kOA== =vRrB -----END PGP SIGNATURE-----

1 0