You want a lot of progress, quickly? Get a dictator.

Want a free society? Accept that changes are going to be slow because there isnt a dictator.

Thats not really what it does, though its sort of close.

NAT covers a large number of different scenarios; the specific one we are discussing is known as Source NAT, or dynamic NAT (or PAT, in the Cisco world).

In this scenario you have a range of private IP addresses that are not publicly routable, and a single publicly routable WAN IP address to be shared among those private hosts. Each IP packet sent will have a source IP, source port, destination IP, and destination port. The router takes each outbound packet, tears down the layer 2, 3, (and possibly 4) headers, and re-writes the "source" port and IP address using a "pool" of NAT IPs and ports. It forwards the rewritten packet on, and stores in a table the mapping of the private host's IP and source port to the NAT IP/port. Return packets matching that pair of NAT IP/port will be translated (rewritten) to target the private host that originally sent them.

The argument being made is that technically this mechanism does not, in itself, identify and block unsolicited traffic-- which is correct. Technically if you were to guess a mapped pair, you could sneak an unsolicited packet through; if I've opened a connection to Google, (my private IP: 192.168.50.5) and my NAT'd IP/port is "5.5.5.5 / 5238", ANYONE could send a packet to that pair and it should get forwarded through.

In reality, there are problems with this that make it difficult to do, the most obvious being that the private host will simply reject that packet as it does not match an active TCP connection that it recognizes. Additionally, this does not work with listening services (which will not have a PAT mapping, as they arent generally initiating connections), and if there are no active conversations no one on the internet will be able to get their traffic to the private host as the router simply wont have any active NAT mappings-- it wont know what to do with the unsolicited traffic, and will dump it.

The "attack" being described is simply to set up a static route on your machine which tells it "ah, but _I_ know how to get to 192.168.50.5-- its through 5.5.5.5!". This could work, as indeed the router would know how to handle the 192.168.50.5 address; the problem is that no other router on the internet will accept a packet destined for that IP address, and you cant just tell those routers how to route the packet. So this attack only works if you are right next to your target-- either their ISP, or some hacker who is on the same cable drop as your neighborhood.

This is why I call it security: if you have no other firewall, NAT (of the sort we mean when discussing consumer routers) will at least ensure that no geographically removed attackers can access your private network, simply by virtue of every other router on the internet refusing to carry the traffic.

The real crux of this argument is that the AC is being pedantic and obnoxious, and conflating static NAT (his iptables examples) with the sort of NAT found on every consumer firewall. If someone is setting up an iptables NAT, they almost certainly are aware of what doing a default policy of ACCEPT will do: it will remove any sort of filtering and all security. But thats not what the context of the conversation was, which is why theres a disagreement here.

Then go get a job at cisco or SANS as their chief security engineer, because you clearly know better than them.

I mean, hey, what would Cisco know. Theyre just the folks behind the PIX, the first device to support NAT.

3 points.

1) Security measures are measures which mitigate vulnerabilities. Mitigations can involve avoiding an issue, or reducing risk. When you take the potential pool of attackers from "the entire internet" and reduce it to "People with direct access to the link between me and my ISP", you have reduced risk. This is Security 101 stuff, its called "risk assessment".

2) No one is suggesting NAT is the best security ever-- just that it provides some degree of security by way of mitigating some threats. Other threats it does not mitigate, and that doesnt really matter because almost no one relies exclusively on NAT anyways.

3) I've provided sources to a number of vendors; I could easily find more. You still have yet to explain why we should toss out Cisco and SANS' explicit statements that NAT constitutes security, and trust your random internet rant. Put up, or shut up.

Because people think the dog is what is doing the detection, when it is not. Like a placebo drug, there may be a beneficial effect, and it may involve the placebo, but it is not due to any characteristic inherent to that placebo. Rather, it is the knowledge that the placebo is present that is useful.

To spell it out more clearly, cops may have very good hunches that someone has drugs, but they cant legally stop that person. The dog acts as a placebo: he "signals" that there are drugs, and everyone believes the dog has detected drugs, but its not the dog doing the detection, its his handler who triggered him.

Im sure some dogs DO detect drugs, but the above scenario has been reported a number of times.

A lawyer wont be able to queue up an alert because the dog hasnt bonded with him.

He actually does know what placebo means, because I've seen articles suggesting what he's saying.

That is, however good a dog's scent of smell is, the real successes come from cops with hunches whose attitude towards the suspect triggers the dog into a "response". Apparently a drug dog response constitutes probable cause, and its well known that dogs are quite attuned to the behavior / stance of their handlers /owners and can be triggered into an aggressive response by the handler.

Wouldnt you want that to return a boolean or a pointer?

Im 90% sure that image is a mockup. The link to Federal times has a much more realistic image.

The Federal Times also notes that the drone is 10 lbs, which further cements my belief that the massive drone in the picture is a mockup or test device.

LoL and Starcraft have been doing esports for many many years now. LoL in particular has been growing quite a bit even as SC2 tapers off in enthusiasm.

Heck, check the page for LoL eSports' Spring 2015 playoffs. Playoff games are getting 250,000 viewers.

Siri does not work with all applications like a keyboard does. I cannot open an arbitrary app's arbitrary text field and dictate into it; this means the only reason I can dicatate youtube searches is because the Youtube app specifically implemented it.

Try SwiftKey for android and you will see what I mean. Dictation is a part of the keyboard, and does not rely on the "personal assistant" app knowing where to stick text.

Interesting, I hadnt seen the 840/50 pro reviews. Theyre somewhat exceptional in that regard, though, Im not aware of general consumer SSDs being able to hold that level of performance.

In any case I was responding to someone discussing the 840 EVO, which is an entirely different animal than the 840 pro, and certainly cannot hold 30k IOPS.

Im pretty sure thats what I said, and no one is arguing that point. You're just insisting on being pedantic and condescending.

Your original statement was that NAT is not security. This post of yours agrees that it is security in some shape. If we're agreeing there, then I dont think theres any reason to keep arguing. If youre disagreeing with that, Id ask you to take it up with the links I provided and with stackexchange. I dont have the time to try to make Cisco and SANS' cases on their behalf, if you are unwilling to take their word on it.\

Because it is an unusual attack scenario, and it would be illegal. It does happen, sure, and defending against a malicious ISP is far beyond the scope of most home security. Luckily for us every consumer OS made in the last 10 years has a stateful firewall, and every consumer router built in the last 10 years has a firewall, so its not an issue.

I mean good grief, 99% of home users are using the ISP provided DNS, and you're worried about probing through NAT in violation of the RFCs? DNS snooping is something that actually happens, and is actually legal. Risk assessment 101: focus on the probable threats.

Without mentioning the need to filter incoming packets, that tutorial concludes: "A computer located in the internet is not able to establish a connection to a local computer, all he can do is address (a port of) the router and hope the best."
Wrong, and leaves anyone who follows the tutorial vulnerable.
As mentioned already, it is impossible in the absence of a published route to your network for someone to reliably send packets directly into a dynamically natted network. The fact that someone could splice onto your cable network is irrelevant, because at that level of effort they could probably climb in through your window and just steal all of your equipment. You're talking about extremely esoteric attacks.

Im perpetuating the stance of major infrastructure vendors. Argue with them. I imagine you could contact support@cisco.com and explain why their statement that NAT fulfills a security role is incorrect.

In the meantime I would suggest you cut the condescending attitude.

If you're asking "what is my proof", check out any anandtech review's "consistency" test on SSDs.

If you're asking what the cause is, I would assume theres a buffer thats getting saturated, or else a cache that is exhausted, or perhaps the SSD controller's CPU gets pegged. Whatever the cause, most SSDs will sustain very high IOPs for a short period of time before falling into a "steady state pattern". For some SSDs it is a wildly swinging pattern, others (higher quality) hold a pretty steady rate around 5-6 IOPS.

Android lets you change keyboards. IOS has something that appears to do this, but it randomly reverts (such as when entering passwords) and is terribly limited compared to Android, not even supporting dictation.