Steven Bellovin is at it again. This time he is paying his keep at Lucent, and the implication are rather disturbing all around.

Remotely Counting Machines behind a NAT box (PDF)