Does the NAT source UDP port depend only on src ip/port?

Question

Does the NAT UDP port depend only on src ip/port?

Suppose I have a two networks connected via a NAT/router using Source NAT.

PC A (192.168.0.2) in Network A (with router 192.168.0.1) sends a UDP packet to PC B (10.0.0.2) in Network B (with router 10.0.0.1). In Network A the packet has src ip/port 192.168.0.2:2000 and dst 10.0.0.2:5000. In Network B it becomes src ip/port 10.0.0.1:6000 (because 6000 is free for whatever reason, just for the example's sake) and dst 10.0.0.2:5000.

Then PC A sends another UDP packet from src ip/port 192.168.0.2:2000 to a different PC in Network B. The source port in Network A is the same, but will it also be the same in network B (6000 in this example)? I assume yes, but I am not sure.

Does it depend on the dst ip/port as well? If not, does it mean one PC, even one src port in Network A, can use up all the NAT hash table entries in Network B? (I hope it takes at least 65536 Network A src ports to fill up the NAT hash table entries in Network B.)

BTW: This question was moved from Stack Overflow, as I think it fits here better.

Answer 1

In your case, it's "NAT overload" (or PAT, NAPT).
It's all about ensuring the uniqueness of the translation entries(local-src ip:port ==> global-src ip:port)

So to answer your questions:
1- If the translation table already contains the following entry:
192.168.0.2:2000 ==> 10.0.0.1:6000 (just for the example's sake), all outgoing connections from 192.168.0.2:2000 will be translated to 10.0.0.1:6000. So your assumption is correct.

2- It depends on the local src-ip and src-port.
So yes, with a theoretical maximum of 65536 PAT entries, 1 device with 65536 outgoing connections from different src-ports, or one src-port from 65536 devices, could fill up the translation table.
In practice, that limit might be reduced by:
- Memory, CPU, available ports(static-PAT/PAR), ...

Answer 2

Current reccomendations are that NAT mappings are Endpoint Independent. That is all packets from the same private client IP/port/protocol use the same public client IP and port even if the desinations are different.

However there is no gaurantee that every NAT you find in the wild will do this. Some may do their translations based on the full 4-tuple (known as a "symmetric NAT").

Particuarlly insiduous are symmetric NATs with port-preserving behaviour. Under light load with random source ports on the client the mappings will appear to be endpoint independent. However if multiple clients on different machines use the same source port the true nature of the NAT will become apparent. I belive linux NAT falls into this category though i'm not positive on that.