ietf
[Top] [All Lists]

RE: Stupid NAT tricks and how to stop them.

2006-03-29 11:48:11
Iljitsch van Beijnum wrote:
...including the RIR reserves which are at an
all time high of nearly 400 million)

Also, keep in mind that the RIRs are not the only ones to have reserves.
The address space itself has reserves, class E for example. ISPs have
reserves, and customer have reserves too (many have been stockpiling).

Besides all this, there is a huge waste out there. Last month I ran some
interesting numbers; the sample is 115 so I'm not saying this is
statistically significant, but I don't think it's too much far off
reality either. Here it is:

Out of my 115 small business consulting customers (5-300 employees,
aDSL/T1/DS3)

- Only one has ISDN (leaves in the middle of nowhere; no DSL, cable but
no static IP).

- 100% use NAT with RFC1918 addresses.

- I had to renumber one customer because they merged with another one
and both were using 192.168.0.0/24.

- 192.168.0.0/24 or 192.168.1.0/24 is the address being used inside 75%
of the time.
 
- 50% have basic NAT boxes (generally the smaller ones), the other half
have boxes that have some packet inspection/content awareness
capabilities.
- Out of this half, more-than-basic firewalling is enabled in only 20%
even though the box is capable of.

- Only one uses a non-NAT proxy server (going away soon) for HTTP
surfing. The others who filter content use a content-aware NAT box
(typically, a PIX or SonicWall querying a Websense server). It appears
that NAT has far less issues than proxy servers.

-  90% use a single IP.
- 100% have been allocated more than a single IP (/29 being
  the smallest, /23 the largest)

- The average IP use is 1.2 IPs per customer. (a)
- The average allocation is 18 IPs per customer. (b)

My 115 customers use 146 IP addresses out of the 2104 allocated to them.
93% waste.

Just to make it clear: I'm not in denial and v4 exhaustion is not FUD,
but the Internet is not going to stop the day after we allocate the last
bit of v4 space either.


BTW, Michel, you said you were about to return from the dark
side in true Star Wars fashion. What gives?  :-)

If you only knew the power of the dark side ;-) Stay tuned.

Michel.


(a) This could be reduced to 1.1 by better configuration. Out of the
dozen who use more than one IP, half really need only one. There this
guy who runs 2 physically different web servers because he has two
domain names, ignoring that he could bind multiple IPs to the same
machine, run a virtual server, or use HTTP headers like everyone else
who hosts thousands of sites on a single machine with cpanel.

Also there appears to be a widely spread phenomenon with PIX boxes that
use a public IP for each inside host (even though the ports are
different); talking with the guys that configured them it looks that PDM
makes it easier that way.


(b) Multiple factors contribute to this.

First, the smallest allocation is a /29; with many ISPs you can't get a
single static you have to waste a /29 to use only 1 IP out of it (90% of
the sample).

Also, I have seen multiple occurrences where the T1 link is on a /30 and
the customer is allocated a /28 for the LAN side. However, the way it's
configured is that the router NATs out using the address of the T1
interface and the customer block, if used at all, is configured in a
loopback for the sole purpose of allowing the ISP's level 1 support to
ping it. In several cases the /28 is not even configured anywhere.


_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/ietf