Live data from Hacker News

How does Linux NAT a ping?

devnonsense.com

91–100 of 108 posts

Re: How does Linux NAT a ping?

#91
post #70

Earlier quoted context omitted.

MDNS, specifically designed for use on a single vlan, so useless

The solution there is DDNS, which is one of the things behind MS AD and just works, and configuring that on pure Unix infrastructure is surprisingly easy.

Layers and layers of fragile interdependencies, and stop doesn’t remove the need for ipv4

Re: How does Linux NAT a ping?

#92
post #58

When a ping is sent from a device on a local network to a device on the internet, the router performing NAT rewrites the source address of the ping to its public IP address and rewrites the ID field of the ICMP packet to a unique value. When the response is received, the router uses the unique ID value to forward the response to the correct device on the local network.

Why not use the source private IP instead of the “unique value”?

Besides “security” which is a byproduct of NAT and not a goal, there’s the fact that an ip address can change. The routing tables usually go to MAC addresses, not ip addresses. So it is easier to store a unique id that fits in that field, that then points to a MAC address, that then points to a ip address.

Re: How does Linux NAT a ping?

#93

Earlier quoted context omitted.

25 years and we've only got 45% We should've been at 95% decades earlier if they came up with an actual transition plan.

"25 years" is not fair. There was no immediate need for IPv6 for anyone 10 years ago, so it should be no surprise that it's not at 95% currently. Now there is.

20 years ago DJB called it [0]. The same problems exist. The only place IPv6 has gained any success is in the mobile market since handsets tend to be homogeneous and therefore configurable, which does allow a decrease in load of CGNAT for carriers. However, this success is not replicated in the broadband realm and probably never will be for all same reasons outlined by DJB. IPv6 is a second class network.

[0]: https://cr.yp.to/djbdns/ipv6mess.html

Re: How does Linux NAT a ping?

#94

Earlier quoted context omitted.

"25 years" is not fair. There was no immediate need for IPv6 for anyone 10 years ago, so it should be no surprise that it's not at 95% currently. Now there is.

20 years ago DJB called it [0]. The same problems exist. The only place IPv6 has gained any success is in the mobile market since handsets tend to be homogeneous and therefore configurable, which does allow a decrease in load of CGNAT for carriers. However, this success is not replicated in the broadband realm and probably never will be for all same reasons outlined by DJB. IPv6 is a second class network. [0]: https:…

> IPv6 is a second class network.

Except it is not. Where it works, it works extremely well. IPv6 connections are, by default, always preferred on all modern operating systems.

I’d also take the entire article with a grain of salt, because it calls a fundamental impossibility (lack if interoperability of v6 and v4 addresses) as a “mistake”. Not having interoperability was the only way, not a “mistake”.

Virtually all the pain points have been dealt with. Any further transition to IPv6 is going to happen without anyone really noticing. Except for the couple of gamers and sysadmins who were wrongly advised to "disable IPv6" to fix "connectivity problems".

Re: How does Linux NAT a ping?

#95

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user…

Not exactly what you're looking for, but your comment about abusing pings made me remember pingfs [1]. It brings an entirely new definition of cloud computing!

[1] - https://github.com/yarrick/pingfs

Re: How does Linux NAT a ping?

#96
post #68

Earlier quoted context omitted.

Most seem to have stopped and are handing out /48’s in my experience. Do you know any not doing that still?

I'm with one of the biggest german internet providers (o2 Telefonia) and they are not even providing any IPv6 at all (at least not in all regions, and without calling support to enable this feature individually).

Thanks for the correction! Hopefully they get their act together soon.

Re: How does Linux NAT a ping?

#97

NAT is such a trashy abstraction. IPv4 needs to die.

IPv6 needs to die. IPv4 using NAT ensures a moderately high level of privacy. IPv6 with privacy extensions does not.

IPv4+NAT still exposes your router's address, which is still problematic, no? If you want more privacy than that you can use a VPN, which should work on IPv6 too.

Re: How does Linux NAT a ping?

#98

I wonder if ping could be abused to send short messages for p2p networking over UDP without a central server to handle NAT busting. Looks like someone figured the message part out: https://stackoverflow.com/questions/31857419/how-to-send-a-m... Unfortunately ping is handled by the OS so apps on the peer IPs wouldn't be able to read the messages. I wonder if it's time to provide hooks to some of these services in user…

It exists: https://samy.pl/pwnat/ (from top comment)

Thanks, ya amazingly it got posted an hour after I asked!

I wasted two years of my life back around 2005 trying to implement P2P networking over UDP through double NAT with TCP fallback through a central server tunnel. It was before promises, coroutines, green threads, software transactional memories (STMs), conflict-free replicated data types (CRDTs), Firebase, CouchDB, Redux, declarative programming, etc etc etc had really gone mainstream. So I lost all of that time reinventing the wheel, only to come up with something that wasn't deterministic, because I couldn't figure out how to fork/join conditional logic around multiple conditions and data sources. My cooperative threads would just stall waiting for some network event after a user had already shut down the game lobby, and I'd find myself trying to use signals/exceptions and polling throughout my business logic.

That experience taught me that async programming isn't the way to go for mission critical code. The way to do it today looks like Raft, where event streams are centrally handled in synchronous blocking code in either an event handler or a separate thread to create a single source of truth like an STM. So last-known global state is available to all peers, the only differences coming from latency, permissions and distance cutoff. Player input as either events or composed states is sent over the network to update each peer's view of the STM to derive the final global state. Then each physics frame, peers simulate playing forward from that state for dead reckoning and update the scene view. The next frame may have a new STM state, so inconsistencies get resolved through animation metaphors like in CSS and Apple's Core Animation. But there should never be any logic that interacts with the network directly or hand waves its way through paradoxes.

Loosely that means that when you hit another player, you may see it lose a life, but then pop back in if the STM decides that the shot was a miss. The game itself is written the standard way, as if all players are on a single server, using (at most) cooperative threads like in Unity to handle game business logic in a coroutine style, rather than using switch commands to implement a state machine around player modes like IS_SPAWNING, IS_SHOT, IS_DYING, etc like most games do. Since everything is sync blocking within each cooperative thread, determinism is guaranteed by eliminating whole classes of bugs.

It would be nice if someone would put together everything I just said in a single package that's infinitely scalable to any number of peers like BitTorrent and runs on Mac/Windows/Linux without requiring a separate process or superuser privileges. The Raft/STM interface should look like a browser's local storage and provide fully indexed distributed associative key-value pairs as a JSON interface with the same transaction limitations as Firebase to allow updating trees with something close to ACID compliance from databases.

If I ever get free of the rat race, I'd like to implement that P2P STM, but without world peace or UBI, I'll probably spend the next 20 years making rent like everyone else. I imagine the lifetimes of knowledge and experience siloed in all of our brains that could get out if we just had an extra 40 hours per week to work on the side projects of our dreams to get real work done and it haunts me. Nearly everything I do now in middle age is a waste of time because it would be straightforward to write better tools to make my job easier, but I'll never have the time to do that. So I toil in obscurity implementing other people's dreams in the hopes that someday one of their successes might help me win the internet lottery. But hey it's a living, and after going through a healing and growth process, just this year coming out of the dark night of the soul, I'm grateful for all of the lost decades and what they taught me about the nature of suffering and why we incarnated in this reality. Maybe the next generation will achieve the revolution that eluded mine.

Re: How does Linux NAT a ping?

#99

Earlier quoted context omitted.

Many ISPs suck. That’s not controversial. We have to deal with the world we live in, not the world we’d like.

That's why variable length SLAAC has been proposed https://datatracker.ietf.org/doc/draft-mishra-6man-variable-...

oh no

Re: How does Linux NAT a ping?

#100
post #33

Earlier quoted context omitted.

You could be using IPv6 ULA addresses internally on your home network to have static addressing. The real solution is moving to DNS names though with your router maintaining them based on DHCP leases or just using multicast DNS (Zeroconf). In the future you can probably go "IPv6-mostly" with a CLAT engine to ditch dual-stack: https://blog.apnic.net/2022/11/21/deploying-ipv6-mostly-acce...

You could, but now you have three addresses per node instead of one. Plus, the mechanisms for assigning those addresses are weird compared to DHCP and static assignment. I get that it facilitates packets being routed reliably, but some of us want maintainable firewall rules that don't have to deal with IP addresses changing out of the blue.

You can DHCP or static assign those addresses the same. The trick to FW rules is you don't route the local prefix out so you only need rules for anything leaving or anything staying.

If you don't need cross subnet communication of your self hosted services you can also get away with just a static link-local and a dynamic general.

Post reply on HN