While I was reading about PAT i.e Port Address Translation.The router was configured to translate all the private IP addresses to one single public IP.Since router is a layer-3 device, it can do that translation by changing the source IP in the IP header. But how does it change the port number in the Transport Layer Header.Can a router do such kind of translation and on what basis does it translates those ports.

Kindly help me with this.Please do let me know If am missing something or I am going in wrong direction.


  • 2
    Possible duplicate of How does the router knows how to route the packets to my terminal?
    – Zac67
    Commented Jan 28, 2018 at 13:16
  • @Zac67 The above answer talk about ip address translation but not port addres translation Commented Jan 28, 2018 at 13:20
  • 1
    A router implementing NAT/PAT needs to be looking at more than the IP address, so it can't only be a layer 3 device. Pure NAT without PAT isn't practical.
    – Zac67
    Commented Jan 28, 2018 at 13:22
  • @Zac67 how does that work then? Commented Jan 28, 2018 at 13:44
  • 1
    @PRANAYKASTHALA from the link Zac67 shared you can see that a router maintains a table of stateful connections which are source IPaddress:port and destination IPaddress:port relationships. Now if you want to know the software implementation of such table that would be off-topic.
    – DRP
    Commented Jan 28, 2018 at 14:52

3 Answers 3


What you are missing is that there is a difference between the functionality of a router as concieved by the people who designed the Internet protocol and the functionality of a modern device that says "router" on the box.

A router as originally invisaged by the creators of the Internet only cared about layer 3 and below. It would strip off the link type specific headers (layers 1/2), perform IP routing (layer 3) and then build a new set of link type specific headers for the next hop.

But modern devices that say "router" on the box often do far more than that. They can and do implement functionality that involves inspecting and modifying the layer 4 headers.


What you are calling PAT, is really NAPT (Network Address Port Translation). The term is defined by RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations:

4.1.2. Network Address Port Translation (NAPT)

NAPT extends the notion of translation one step further by also translating transport identifier (e.g., TCP and UDP port numbers, ICMP query identifiers). This allows the transport identifiers of a number of private hosts to be multiplexed into the transport identifiers of a single external address. NAPT allows a set of hosts to share a single external address. Note that NAPT can be combined with Basic NAT so that a pool of external addresses are used in conjunction with port translation.

For packets outbound from the private network, NAPT would translate the source IP address, source transport identifier and related fields such as IP, TCP, UDP and ICMP header checksums. Transport identifier can be one of TCP/UDP port or ICMP query ID. For inbound packets, the destination IP address, destination transport identifier and the IP and transport header checksums are translated.

A NAPT router in figure 2 may be configured to translate sessions originated from N-Pri into a single external address, say Addr-i.

Very often, the external interface address Addr-Nx of NAPT router is used as the address to map N-Pri to.

RFC 3022, Traditional IP Network Address Translator (Traditional NAT) goes into more detail. With NAPT, the device performing the NAT must look at the UDP, TCP, and ICMP datagrams, and it must modify those, too. That involves a lot of processing, and it is resource intensive.

NAPT really only works for UDP, TCP and ICMP. Other transport protocols have a problem with NAPT, and some application-layer protocols can break with NAPT. IP was conceived as an end-to-end protocol, where each host has a unique address, and NAPT breaks the IP model.

2.2. Overview of NAPT

Say, an organization has a private IP network and a WAN link to a service provider. The private network's stub router is assigned a globally valid address on the WAN link and the remaining nodes in the organization have IP addresses that have only local significance. In such a case, nodes on the private network could be allowed simultaneous access to the external network, using the single registered IP address with the aid of NAPT. NAPT would allow mapping of tuples of the type (local IP addresses, local TU port number) to tuples of the type (registered IP address, assigned TU port number).

This model fits the requirements of most Small Office Home Office (SOHO) groups to access external network using a single service provider assigned IP address. This model could be extended to allow inbound access by statically mapping a local node per each service TU port of the registered IP address.

In the example of figure 3 below, stub A internally uses class A address block The stub router's WAN interface is assigned an IP address by the service provider.

                                 \ | /
                               |Service Provider Router|
                             WAN |
             Stub A .............|....
     ^{s=,sport=1024, |  v{s=, sport = 23,
     ^ d=,dport=23}   |  v d=, dport = 1024}
                     |Stub Router w/NAPT|
                       |  LAN
    |        ^{s=,sport=3017, |  v{s=, sport=23,
    |        ^ d=,dport=23} |  v d=, dport=3017}
    |                                  |
   +--+      +--+                    +--+
   |--|      |--|                    |--|
  /____\    /____\                  /____\   .....

  Figure 3: Network Address Port Translation (NAPT) Operation

When stub A host sends a telnet packet to host, it uses the globally unique address as destination, and sends the packet to it's primary router. The stub router has a static route for the subnet so the packet is forwarded to the WAN-link. However, NAPT translates the tuple of source address and source TCP port 3017 in the IP and TCP headers into the globally unique and a uniquely assigned TCP port, say 1024, before the packet is forwarded. Packets on the return path go through similar address and TCP port translations for the target IP address and target TCP port. Once again, notice that this requires no changes to hosts or routers. The translation is completely transparent.

In this setup, only TCP/UDP sessions are allowed and must originate from the local network. However, there are services such as DNS that demand inbound access. There may be other services for which an organization wishes to allow inbound session access. It is possible to statically configure a well known TU port service [RFC 1700] on the stub router to be directed to a specific node in the private network.

In addition to TCP/UDP sessions, ICMP messages, with the exception of REDIRECT message type may also be monitored by NAPT router. ICMP query type packets are translated similar to that of TCP/UDP packets, in that the identifier field in ICMP message header will be uniquely mapped to a query identifier of the registered IP address. The identifier field in ICMP query messages is set by Query sender and returned unchanged in response message from the Query responder. So, the tuple of (Local IP address, local ICMP query identifier) is mapped to a tuple of (registered IP address, assigned ICMP query Identifier) by the NAPT router to uniquely identify ICMP queries of all types from any of the local hosts. Modifications to ICMP error messages are discussed in a later section, as that involves modifications to ICMP payload as well as the IP and ICMP headers.

In NAPT setup, where the registered IP address is the same as the IP address of the stub router WAN interface, the router has to be sure to make distinction between TCP, UDP or ICMP query sessions originated from itself versus those originated from the nodes on local network. All inbound sessions (including TCP, UDP and ICMP query sessions) are assumed to be directed to the NAT router as the end node, unless the target service port is statically mapped to a different node in the local network.

Sessions other than TCP, UDP and ICMP query type are simply not permitted from local nodes, serviced by a NAPT router.


When a Router (or any other device) is doing a Static NAT or a Dynamic NAT, it is only inspecting the packet up to Layer 3.

When a Router (or any other device) is doing a Static PAT or a Dynamic PAT, it must inspect the packet up to Layer 4. In such cases, the Router is indeed doing more than "just Layer 3" processing.

Routing is a function of Layer 3, and traditionally the device created to handle Routing is a Router. But, Routers are not limited to only L3 processing. If they are changing ports, they have crossed over into Layer 4 territory.

  • 2
    Even 1:1 NAT has to modify the TCP/UDP header due to the way the checksums are defined. Commented Mar 16, 2018 at 16:40
  • @PeterGreen Yes. Good point. I suppose I was trying to over simplify it.
    – Eddie
    Commented Mar 17, 2018 at 19:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.