This document provides an overview and instructions for Lab 5 on Network Address Translation (NAT). It discusses: 1) Keeping ICMP error handling from Lab 3 and rewriting packet source IPs for outbound traffic, with original IPs restored for incoming packets. 2) Responsibilities for ping (ICMP echo) and HTTP file downloads (TCP). 3) Cleaning out NAT mappings based on TCP state and customizable timeout values for different connection types.

1. Lab 5: NAT
Arda Kara
CS 144
Friday, November 18, 11

2. Overview
• lab 5 builds on lab 3
• myths and internet are inside (eth0), app servers
are outside (eth>0)
• ICMP echo and TCP
• NAT will rewrite source IPs of outbound packets
• clean up defunct mappings
Friday, November 18, 11
1) keep all ICMP errors from lab 3, the non -n version should function the same
2/3) packets from myth to app server will be rewritten with NAT’s external IP. incoming
packets will get back their original IP. The internal IPs are not private 10. IPs
4) You will be responsible for ping (ICMP echo) and downloading files over HTTP (TCP)
5) clean out mappings based on TCP state, etc.

3. Parts
• ICMP:
translate IP addr and query identifier (a la port)
• TCP:
endpoint-independent mapping and filtering,
simultaneous-open for unsolicited SYNs
• Mapping: any non-common port (>1023)
• Clean-up:
use the MAPPINGTYPE_TIMEOUT values,
separate thread to go through and clean-up
• Testing:
NAT topology, served page displays addr/port,
filtering, reference binary
Friday, November 18, 11
ICMP: the combination of query/sequence numbers should be unique. you can think of the
query identifier as the port. you should have endpoint-independent-mapping
TCP: end-independent mapping and filtering. recalculate checksum (including
pseudoheader). simul open -> both sides first send SYNs
Clean-up: remember to lock table. go through and mark for deletion. look at how the ARP
cache worked. do not return mappings that are marked-for-deletion. make sure you use the
customizable values of ICMP, Established TCP and Transitory TCP timeouts
Testing: filtering makes sure you can put packets on the right side of the NAT

4. Lab 5
Due December 7
Last year’s Piazza
http://piazza.com/public/ge57akd2pfn#other/cs144fall2010
Start early
Friday, November 18, 11