第十章穿越NAT的技术ppt课件

《第十章穿越NAT的技术ppt课件》由会员分享，可在线阅读，更多相关《第十章穿越NAT的技术ppt课件（37页珍藏版）》请在装配图网上搜索。

1、TCP穿越NAT的技术的比较NAT DefinitionvNAT is Network Address Translation(网络地址转换器)v一种让多台计算机共享一个互联网地址的技术，得到内部地址的计算机只可以经过NAT，才可以与公网通讯。NAT运用端口转换技术port translation来确定哪个内部计算机应该得到来自公网的前往信息。NAT的四种类型v1.Full Conev2.Restricted Conev3.Port Restricted Conev4.Symmetric1.Full ConevNAT会将内外主机地址X:y转换成公网地址A:b并绑定；任何外网主机都可以经过地址A

2、:b送到内网主机的X:y地址上。vNAT不限制外网的IP和端口2.Restricted ConevNAT会将内网主机地址X:y转换成公网地址A:b并绑定；只需来自主机P的数据包才干和X:y进展通讯。v其中P是内网主机自动联络过的。vNAT检查外网的源IP3.Port Restricted ConevNAT会将客户机地址X:y转换成公网地址A:b并绑定；只需来自主机P：q的数据包才干和X:y进展通讯。v其中主机运用P：q是内网主机自动发起联络的；vNAT检查外网到达的IP和PortvNAT的映射点(A:b)对不同的Session能够一样4.Symmetricv只需来自一样内部IP地址和端口号，并

3、且发送同一个目的地址和端口的恳求音讯才干被映射为一样的外部地址和端口号。同时，一个NAT以外的外部节点可以向NAT之后的节点发送数据包，当且仅当在这之前该外部节点曾接纳过该内部节点发送给他的UDP数据包。NAT problemsvNAT外面的用户不可以自动建立与NAT内部用户的衔接v当两个用户都位于NAT后面,不可以建立衔接v尤其是对P2P网络运用、游戏、网络等运用SolutionsvNAT Transversal Techniques(NAT穿越技术)vNat gateway optimized and plugged techniques:v1.Universal Plug and Pla

4、y(UPnP)v2.Application Level GatewayvEmploy relay serverv3.STUNv4.TCP/UDP hole punching1.UPnP NAT TraversalvUPnP:Universal Plug and PlayvWindows Internet Sharing(ICS)in Windows XPvBased on TCP/IP2.Application Level GatewayvDNS Application Level Gateway(DNS_ALG)helps translate Name-to-Private-Address

5、mapping in DNS payloads into Name-to-external-address mapping and vice versa using state information available on NAT v位于NAT或防火墙v要求改动NAT、防火墙的配置，限制其推行SolutionsvNAT Transversal Techniques(NAT穿越技术)vNat gateway optimized and plugged techniques:v1.Universal Plug and Play(UPnP)v2.Application Level Gateway

6、vEmploy relay serverv3.STUNv4.TCP/UDP hole punching预备知识：NAT Relaying1.用户与中继效力器建立联络2.中继效力器转发音讯问题:1.效力器耗费的时间、计算量大2.通讯时延大3.网络带宽资源的耗费.3.STUNRFC 3489 UDP穿越NAT的技术STUN Client C(CIP:CPort)STUN Server S(SIP:SPort)NAT(NIP:NPort)STUN Request(UDP)(C I P:C P o r t)-(SIP:SPort)STUN Request(UDP)(NIP:NPort)-(SIP:SP

7、ort)3.STUN RFC 3489 UDP穿越NAT的技术STUN Client C(CIP:CPort)STUN Server S(SIP:SPort)STUN Response(SIP:SPort)-(NIP:NPort)将将(NIP:NPort)反响给用户反响给用户NAT(NIP:NPort)N AT 将将 (C I P:C P o r t)映 射 成映 射 成(NIP:NPort)3.STUN 发现NAT类型的方法STUN Client C(CIP:CPort)第一次应对第一次应对NIP：NPortSTUN Server S(SIP:SPort)STUN Request(UDP)(

8、C I P:C P o r t)-(UIP:UPort)STUN Request(UDP)(N I P 2:N P o r t 2)-(UIP:UPort)STUN Server U(UIP:UPort)STUN Response(U I P:U P o r t)-(NIP2:NPort2)比较两次应对的结果(NIP:NPort)NIP2:NPort2：symmetric NAT3.STUN 发现NAT类型的方法STUN Client C(CIP:CPort)STUN Server S(SIP:SPort)STUN Request(UDP)(C I P:C P o r t)-(UIP:UPor

9、t)STUN Request(UDP)(N I P 1:N P o r t 2)-(UIP:UPort)STUN Server U(UIP:UPort)STUN Response(S I P:S P o r t)-(NIP2:NPort2)1.倘假设发送端收到应对：full cone NAT2.没有收到应对，那么不是full cone NAT4.TCP/UDP hole punchingBran Ford,Massachusetts Institute of TechnologyPyda Srisuresh,Caymas Systems,Inc.USENIX Annual Technical

10、Conference,April 2005 Connection ReversalClient B(10.0.010)Server S(18.18.1.1)Client A(8.8.8.8)Reverse Connection RequestRelayed Connection RequestReverse Connectionv根本思想：运用一个中继效力器来建立P2P衔接hole punchingv前提：v隐藏在NAT后面用户都曾经与中继效力器建立了UDP衔接v效力器知道用户的转换地址/端口，以及用户在内网的地址/端口，经过比较这两对数据，就可以判别用户能否是隐藏在NAT后面的用户。UDP

11、Hole Punching(S,SP)(A,AP)(B,BP)(NA,NAP)(NB,NBP)Session A-S(A,AP)-(S,SP)Session A-S(NA,NAP)-(S,SP)Session B-S(B,BP)-(S,SP)Session B-S(NB,NBP)-(S,SP)UDP Hole Punching(S,SP)(A,AP)(B,BP)(NA,NAP)(NB,NBP)Help me reach BUDP Hole Punching(S,SP)(A,AP)(B,BP)(NA,NAP)(NB,NBP)B is at(NB,NBP)A is at(NA,NAP)UDP Ho

12、le Punching(S,SP)(A,AP)(B,BP)(NA,NAP)(NB,NBP)vProblem:vUDP traversal doesnt work for Symmetric NatTCP Hole Punching(S,SP)(A,AP)Connect soket for S(B,BP)Connect soket for S(NA,NAP)(NB,NBP)Help me reach BTCP Hole Punching(S,SP)(A,AP)Connect soket for S(B,BP)Connect soket for S(NA,NAP)(NB,NBP)B is at(N

13、B,NBP)A is at(NA,NAP)TCP Hole Punching(S,SP)(A,AP)Connect soket for SConnect soket for B(B,BP)Connect soket for SConnect soket for ASYNSYNTCP Hole Punching(S,SP)(A,AP)Connect soket for SConnect soket for B(B,BP)Connect soket for SConnect soket for AACKACKTCP Hole Punching(S,SP)ProblemvInconsistent e

14、ndpoint translationvSame as for UDP(NAT没有一致的规范,因此,任何穿越NAT的技术都有失效的情况)vNAT could reject“unsolicited incoming SYNsvwith RSTs or ICMP errs instead of just droppingv Connection failures,retry oscillationvBuggy TCP state machine in host OSvWindows before XP SP2TCP/UDP hole punchingv协助建立P2P衔接v优点：v不需求知道网络拓扑

15、、NAT的位置v不需求改动NAT配置v缺陷：v在symmetric NAT中无效v82%的NAT支持UDP hole punchingv64%的NAT支持TCP hole punchingStuntNUTSS:A SIPbased Approach to UDP and TCP Network ConnectivitySaikat Guha,Cornell UniversityvProxy:pass messages between hosts A and B to coordinate the establishment of TCP.vSTUNT Server must be placed

16、 in the public internet and must be able to spoof IP source addresses.vsolid lines:actual TCP packets vdashed lines:messages sent between hosts and their STUNT Servers,or between themselves via Proxies.referencevBIGGADIKE,A.,FERULLO,D.,WILSON,G.,AND PERRIG,A.NATBLASTER:Establishing TCP connections b

17、etween hosts behind NATs.In Proceedings of ACM SIGCOMM ASIA Workshop(Beijing,China,Apr.2005).vEPPINGER,J.L.TCP Connections for P2P Apps:A Software Approach to Solving the NAT Problem.Tech.Rep.CMU-ISRI-05-104,Carnegie Mellon University,Pittsburgh,PA,Jan.2005.vFORD,B.,SRISURESH,P.,AND KEGEL,D.Peer-to-

18、peer communication across network address translators.In Proceedings of the 2005 USENIX Annual Technical Conference(Anaheim,CA,Apr.2005).vGUHA,S.,TAKEDA,Y.,AND FRANCIS,P.NUTSS:A SIP-based Approach to UDP and TCP Network Connectivity.In Proceedings of SIGCOMM04 Workshops(Portland,OR,Aug.2004),pp.4348

19、.3.STUN 的用途1th UDP 测试测试无应对无应对制止制止UDP有应对有应对映射地址与源地址一样映射地址与源地址一样映射地址与源地址不一样映射地址与源地址不一样2th UDP 测试测试2th UDP 测试测试Binding Request with change IP&change port flags 无应对无应对有应对有应对In Internet无应对无应对1th UDP 测试测试有应对有应对Full Cone应对应对IP不一样不一样Symmetric NAT应对应对IP一样一样3thUDP测试测试Binding Request with only the change port flag 无应对Port Restricted 有应对Restricted Cone