Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I could not explain the strange NAT behavior, hope someone could help:

I have a linksys wrt54g router at home.

  1. Client sends UDP keep alive packet from 192.168.1.20:16688 (nat outside public IP/port is known by STUN) to a public server every 15 seconds. (public server will ignore client keep alive packets and not sending response back)
  2. sever sends random messages (a few packets) back to client's NAT public address/port
  3. client receives packets from server OK

However, client only receives messages from server once, after that client no longer can receive messages from server. I have sniffered the NAT outside link and the packets do reach the NAT. Looks like the NAT port mapping is removed even with keep alive packet send every 15 seconds.

I have tested other NAT and do not see such problem.

Thanks,

Daniel

share|improve this question
    
UDP nat implementations are often fraught with peril. My guess is the server isn't sending Keep-alives, or that the udp response window is smaller than expected, perhaps to mitigate DOS attacks using UDP floods of keep-alives. –  Frank Thomas Mar 19 '13 at 19:14
    
Hi Frank, thanks for your comments. I will try to send keep alive every second and see what happens. Daniel –  Daniel Mar 19 '13 at 19:21
    
Send keep alive packet every second does not help. Interestingly, after received some packets from server the port is blocked. If I restart client and use another client source port, I can receive from server once and then the port is blocked again. How to explain this strange NAT behavior? My wrt54g firmware version is v1.01.04 –  Daniel Mar 21 '13 at 16:58
    
my guess is its done to mitigate udp flooding. en.wikipedia.org/wiki/UDP_flood_attack –  Frank Thomas Mar 21 '13 at 22:46
    
I have a VoIP service (iTalkBB) which works fine. Client sends UDP SIP Register message (using port 10000) every minute or so. The only difference is that the server sends back response for each register. Do you think this cheap router is sophisticate enough to differentiate these two conditions? –  Daniel Mar 26 '13 at 18:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.