Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Grokking NAT and packet mangling in Linux

vivekn.dev

Post reply on HN
Print view View original

11–20 of 41 posts

Re: Grokking NAT and packet mangling in Linux

#11

Post by zokier »

colmmacc wrote: post #5

A significant wrinkle in how NAT works is IP fragmentation. UDP datagrams can be larger than an IP packet. When that happens the payload is split into multiple IP packets, but only the first packet has a UDP header in it. The NAT device needs to correlate these packets by looking at fragment IDs, and then rewrite the IP addresses in the headers. That alone implies a second kind of state to maintain, but it gets worse…

IP fragmentation does not really have anything to do with UDP, it can happen regardless of the inner protocol.

> Worst of all, this was all avoidable.

It is not that simple. To avoid fragmentation you need robust path mtu detection, which is another whole can of worms. Especially when packets can have multiple paths with different mtu.

Re: Grokking NAT and packet mangling in Linux

#13

Post by GuinansEyebrows »

jxjnskkzxxhx wrote: post #10

OT does anyone else find it off topic to see the word "grokking"? Does that mean understanding? Do we need a new word for this extremely basic concept?

"Grok (/ˈɡrɒk/) is a neologism coined by the American writer Robert A. Heinlein for his 1961 science fiction novel Stranger in a Strange Land. While the Oxford English Dictionary summarizes the meaning of grok as "to understand intuitively or by empathy, to establish rapport with" and "to empathize or communicate sympathetically (with); also, to experience enjoyment", Heinlein's concept is far more nuanced, with critic Istvan Csicsery-Ronay Jr. observing that "the book's major theme can be seen as an extended definition of the term." The concept of grok garnered significant critical scrutiny in the years after the book's initial publication. The term and aspects of the underlying concept have become part of communities such as computer science. "

https://en.wikipedia.org/wiki/Grok

Re: Grokking NAT and packet mangling in Linux

#14

Post by theideaofcoffee »

jxjnskkzxxhx wrote: post #10

OT does anyone else find it off topic to see the word "grokking"? Does that mean understanding? Do we need a new word for this extremely basic concept?

It's a pretty common, well-accepted use in the hacker lexicon. See esr's Jargon File [0] where, by some sources [1][2], it started being used in its capacity as meaning 'understanding' for forty-ish years now at this point.

[0] http://www.catb.org/jargon/html/G/grok.html

[1] https://books.google.com/books?id=uS4EAAAAMBAJ&pg=PA32#v=one...

[2] https://en.wikipedia.org/wiki/Grok#In_computer_programmer_cu...

Re: Grokking NAT and packet mangling in Linux

#16

Post by esseph »

jekwoooooe wrote: post #7

I remember back in the day I had to help a hospital set up some crazy double nat Cisco vpn to another hospital. Old school physical appliance and everything. It was such a pain

"Old school physical appliance"

Lololol

It's so funny to me how much the past 10 years absolutely decimated on-prem skills a In some areas.

I don't know what to tell you folks other than Real Locations doing Physical Things still exist, haven't gone away, and there's actually more of them now than there was.

Given the current state of cyber attacks, all eggs in one basket is probably a very bad thing. For instance, CISA has put out many notices that they consider MSPs a massive security liability. Cloud services are also a weak point.

Digital sovereignty anyone???

Re: Grokking NAT and packet mangling in Linux

#17

Post by [deleted] »

zokier wrote: post #11
colmmacc wrote: post #5

A significant wrinkle in how NAT works is IP fragmentation. UDP datagrams can be larger than an IP packet. When that happens the payload is split into multiple IP packets, but only the first packet has a UDP header in it. The NAT device needs to correlate these packets by looking at fragment IDs, and then rewrite the IP addresses in the headers. That alone implies a second kind of state to maintain, but it gets worse…

IP fragmentation does not really have anything to do with UDP, it can happen regardless of the inner protocol. > Worst of all, this was all avoidable. It is not that simple. To avoid fragmentation you need robust path mtu detection, which is another whole can of worms. Especially when packets can have multiple paths with different mtu.

[deleted]

Re: Grokking NAT and packet mangling in Linux

#18

Post by usrme »

gregw2 wrote: post #3

Nice writeup on the different type of NATs. I learned something, thank you! One feedback; I would use a different word ("wrangling"?) rather than "mangling" in your title. Or mention IPv6. The title use of "mangling" alone triggered flashbacks of tracking down TCP checksum corruption in low cost home routers, or bugs in OpenBSD networking stacks back when I worked on web conferencing software. I that kind of mangling…

If you enjoyed this, then definitely read through Tailscale's lengthy write-up about NAT traversal: https://tailscale.com/blog/how-nat-traversal-works

Re: Grokking NAT and packet mangling in Linux

#19

Post by tptacek »

Bluecobra wrote: post #9
colmmacc wrote: post #5

A significant wrinkle in how NAT works is IP fragmentation. UDP datagrams can be larger than an IP packet. When that happens the payload is split into multiple IP packets, but only the first packet has a UDP header in it. The NAT device needs to correlate these packets by looking at fragment IDs, and then rewrite the IP addresses in the headers. That alone implies a second kind of state to maintain, but it gets worse…

Not sure if I agree with it being the worst mistake. The beauty of UDP is its simplicity and you get the absolute minimum. (And that’s the way I like it!) I’ve worked on low latency financial networks that route 40+ Gb of UDP multicast daily and error free. Nobody is fragmenting UDP packets, and most packet sizes are less than 1000 bytes. All financial exchanges have their own proprietary format, but all use sequence…

A UDP protocol that deliberately keeps datagram sizes below 1000 bytes to avoid fragmentation is essentially handling fragmentation itself, as Colm proposes UDP should have done to begin with.

Re: Grokking NAT and packet mangling in Linux

#20

Post by pak9rabid »

theideaofcoffee wrote: post #14
jxjnskkzxxhx wrote: post #10

OT does anyone else find it off topic to see the word "grokking"? Does that mean understanding? Do we need a new word for this extremely basic concept?

It's a pretty common, well-accepted use in the hacker lexicon. See esr's Jargon File [0] where, by some sources [1][2], it started being used in its capacity as meaning 'understanding' for forty-ish years now at this point. [0] http://www.catb.org/jargon/html/G/grok.html [1] https://books.google.com/books?id=uS4EAAAAMBAJ&pg=PA32#v=one... [2] https://en.wikipedia.org/wiki/Grok#In_computer_programmer_cu...

Also, have we all forgotten about Groklaw already?
Post reply on HN