Sorry for my limited knowledge in Networking.

If I understand correctly port numbers are application level addresses for network communication, e.g. port no 20 is assigned for FTP.

In PAT, we map one external IP address to multiple internal addresses. The mapping uses port numbers as shown in the following figure.

enter image description here

Here the port numbers are 1000, 1001, 1002.

My question is how the mapping will be if all the hosts in the local network are trying to connect the remote machine using FTP (port no 20) at the same time?. In this case how to uniquely identify the local machine when sending and receiving packets?


Ports are addresses used by some transport-layer protocols, not application addresses.

The NAT table for NAPT (PAT is really a misnomer, see RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations) will use the source and destination IPv4 and transport addresses and come up with a random port for the transport protocol.

The transport address on the remote host will multiplex to allow different connections. Web servers do this all the time. It is not unusual for a web browser to open multiple TCP connections from a host to the web server in order to get multiple page elements at the same time, and the server and browser maintain separate connection between them. RFC 793, Transmission Control Protocol explains multiplexing and connections:


To allow for many processes within a single Host to use TCP communication facilities simultaneously, the TCP provides a set of addresses or ports within each host. Concatenated with the network and host addresses from the internet communication layer, this forms a socket. A pair of sockets uniquely identifies each connection. That is, a socket may be simultaneously used in multiple connections.

The binding of ports to processes is handled independently by each Host. However, it proves useful to attach frequently used processes (e.g., a "logger" or timesharing service) to fixed sockets which are made known to the public. These services can then be accessed through the known addresses. Establishing and learning the port addresses of other processes may involve more dynamic mechanisms.


The reliability and flow control mechanisms described above require that TCPs initialize and maintain certain status information for each data stream. The combination of this information, including sockets, sequence numbers, and window sizes, is called a connection. Each connection is uniquely specified by a pair of sockets identifying its two sides.

When two processes wish to communicate, their TCP's must first establish a connection (initialize the status information on each side). When their communication is complete, the connection is terminated or closed to free the resources for other uses.

Since connections must be established between unreliable hosts and over the unreliable internet communication system, a handshake mechanism with clock-based sequence numbers is used to avoid erroneous initialization of connections.

| improve this answer | |
  • Thanks for the answer. If they assign random ports both hosts initiate FTP connections/whatever application will use some random port numbers in the PAT table. Am I correct? So who decides these numbers? The router or the host? – user570593 Jan 4 '18 at 3:51
  • The NAT device (usually a router or firewall) decides the random source port. It is what maintains the NAT table, so it is the only device that needs to know which new addresses relate to which original addresses. By the way, NAT devices do not share tables, so sites with two routers running NAT can have a problem with asymmetric routing (the reply comes into the other router). – Ron Maupin Jan 4 '18 at 4:01

You can't map (private) IP addresses to (public) IP:port combinations. The NAT router always maps IP:port to IP:port combinations.

For private to public connections (dynamic source NAT), these mappings are somewhat random and change over time. The private port is chosen by the client, the public port is selected from the NAT router's pool.

To enable connections from public to private - a host behind the NAT router - a public port on the router's public IP needs to be statically mapped to a private IP:port combination (destination NAT).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.