Hacker News Reader

Comment by 0x0 | Hacker News Reader

I think it can be useful when the TCP connection is going through NAT which may drop the rule and stop passing packets after idling, no?

View on HN

Yep, crappy routers tend to do this :/

It's not a real router if it does NAT. NAT is just a half assed proxying hack for hosts not on the internet.

A Juniper MX960 can do NAT. Is that not a router?

If it's configured to do NAT instead of routing, then it's not being a router. Routing is a job and "router" describes a role, not a static property of a box. Like firewall, bridge, etc.

Routing is defined as shuffling packets where they need to go unmolested - without messing with the address or port fields. It's specced in the IP RFC's. If you're mangling the traffic, you're violating router requirements.

You're never seen a router have to do NAT for two subnets that it's routing between?

While I certainly share your dislike of NAT, this is just absurd.

In retrospect, I think using TCP_KEEPALIVE would be a better solution to this specific use case. Are TLS heartbeats truly indistinguishable from normal traffic?

TCP Keepalive is a much better solution for this problem.

Nearly all bitcoin pools utilize TCP keepalive to maintain connections with miners.

These are systems in which performance and DoS resistance are paramount.

My understanding, from the heartbleed page, is that the packets for the heartbeat have a specific packet type identifier and that you can use this to train an IDS to watch for the heartbleed attack.

I would guess that makes them identifiable?

Reply on news.ycombinator.com