[e2e] Identifying firewalled and NATed hosts

[Agthorr]

I'm working on a Gnutella measurement study.  Using a crawler I
developed, I capture snapshots of the Gnutella overlay topology.
Unfortunately, a significant fraction of Gnutella nodes are so
overwhelmed that their TCP connection backlog is full and they refuse
connection attempts with an RST packet.  I know they are aren't
firewalled because I can connect to them eventually if I am
persistent.

To better characterize this problem, I'd like to distinguish these
hosts from firewalled and NATed hosts.  Continually trying to connect
to the overwhelmed hosts is both time-consuming and a bit invasive.

Is there a quick, not-too-invasive test I can perform to identify an
IP address as a NAT device rather than an end-host?

-- 
Daniel Stutzbach                           Computer Science Ph.D Student
http://www.barsoom.org/~agthorr                     University of Oregon