Possible typo in Tanenbaum's book about NAPT

Question

From what I have understood from multiple sources (web and other books) about the concept of NAPT (also called NAT overload or IP masquerading in Linux environment), if there is a scenario like the following:

when a packet arrives at the NAT box from the ISP, it is the DESTINATION PORT(and not the SOURCE PORT of the incoming packet) in the TCP header which is extracted and used as an index into the NAT box's mapping table to locate the proper entry in that table.

But in Tanenbaum's book (Computer Networks 5th edition) on page 454, chapter 5, it's said that it's the SOURCE PORT the one which is extracted from the TCP header of the incoming packet, but this make no sense to me since the SOURCE PORT of the incoming packet was the DESTINATION PORT of the outgoing packet and therefore there is no entry in the NAT table which matches it.

These two schemes are some of the sources found on the web which helped me in the study of the NAPT:

From what I seem to understand following the above scheme when the packet comes back it will have in the source port filed 110 and in the destination port field 14500. Then the value 14500 of the destination is extracted from the TCP header and is used to locate the first entry in the NAT table.

Answer 1

You are partly right, but Tanenbaum is not wrong. Perhaps part of the confusion is what is meant by source port of the outgoing packets (there are the internal, and the external).

Both the source and destination ports of the incoming packet are used

When you initiate a connection from inside your network to an external destination, e.g., a web server on port 80, your source port and source IP address are, say, SP1 and SIP1, the destination IP address is DIP and destination port 80. But when sending it out, the NAPT will use the external IP address SIP as the source, through a port, say, P1. So the NAPT will add an entry like

SIP:P1 ; DIP:80 <==> SIP1:SP1

If another machine in the internal network, with SP2 and SIP2, initiates a connection to the same web server, the outgoing source IP address from the NAPT will be the same (SIP), but with a different source port (P2), and then we have the table now as

SIP:P1 ; DIP:80 <==> SIP1:SP1

SIP:P2 ; DIP:80 <==> SIP2:SP2

Let's say you open a connection to another machine, DIPx and port P1x, with your IP address still SIP1, but this time from source port SPx, then the NAPT table becomes

SIP:P1 ; DIP:80 <==> SIP1:SP1

SIP:P2 ; DIP:80 <==> SIP2:SP2

SIP:Px ; DIPx:P1x <==> SIP1:SPx

So you can see that if there is an incoming packet from the outside, the NAPT wants to look at the source IP address and port. This will be DIP and port 80. Furthermore, the destination port would be P1 (if it is responding to the first machine) or P2 (if to the second). Taken together then, both the source and destination ports, provide the needed index into the table. So, if we have source DIP:80 and destination port P1, then there is the one entry in the table, where we get SIP1:SP1 for the internal IP address and port. Notice how P1 and SP1 are different (which may have been the source of your confusion)

Answer 2

Actually, the NAT tables for NAPT (one for each of TCP, UDP, and ICMP) are a bit more complex than you seem to understand. The table entries are based on the source and destination addresses, including the port numbers for TCP and UDP, and the ICMP query IDs.

when a packet arrives at the NAT box from the ISP, is the DESTINATION PORT(and not the SOURCE PORT of the incoming packet) in TCP header which is extracted and used as an index into the NAT box's mapping table to locate the properly entry in that table.

That is not really true for NAPT for dynamic table entries created from inside-initiated connections because you may have more than one host on the inside that is using that TCP port number for a connection, and if what you claim is true, then all return traffic would only go to one of the hosts using that port number. By using more values for the index, you could have any number of TCP connections through the NAPT box that use the same port number.

I think you are confusing the fact that you may need to set up a permanent table entry (port forwarding) for outside-initiated traffic. In that case, only the destination port is known beforehand, so that is what is used to determine the inside destination address.