0

I have tried packet tracer and actual cisco routers and I find this weird: NAT uses different source ports, usually incrementally, for consecutive packets from the same connection. Why is that?

Assume I am pinging an external server from a client on my private network. the client PC sends 3 ICMP echo-request packets. When I check out the NAT translations table on the router, there are 3 entries; from the same source IP address to the same destination IP address but each have a different port number. Shouldn't there be just one entry? BTW, that is the case with different kinds of NAT including dynamic NAT and PAT.

This is taken from a cisco academy lab.

Improve this question
5
  • 2
    ICMP packets don’t have port numbers.
    – Ron Trunk
    Commented Aug 8, 2018 at 18:50
  • I know that ICMP doesn't use port numbers. I'm using NAT terminology. What do you call the number after the colon and the IP_add in the translation table (33 - 35 in the following example)? Pro Inside global Inside local Outside local Outside global icmp 209.165.200.225:33192.168.1.20:33 209.165.201.17:33 209.165.201.17:33 icmp 209.165.200.225:34192.168.1.20:34 209.165.201.17:34 209.165.201.17:34 icmp 209.165.200.225:35192.168.1.20:35 209.165.201.17:35 209.165.201.17:35
    – 4everlearner
    Commented Aug 9, 2018 at 0:54
  • 1
    Those are ICMP Query IDs, and each ICMP query uses a different Query ID because it is a different query. ICMP, as a connectionless protocol, doesn't have connections, so each ICMP query stands on its own. Ping is an application that usually sends several ICMP queries, but ICMP doesn't relate those queries to each other. They must be separate so that the replies to the Query ID do not get mixed up with the other queries.
    – Ron Maupin ♦
    Commented Aug 9, 2018 at 1:13
  • "I'm using NAT terminology." Actually, no, you are not. There is an RFC for proper NAT terminology: RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, where you will find things like NAPT, but not PAT, and it will explain about ICMP Query IDs.
    – Ron Maupin ♦
    Commented Aug 9, 2018 at 13:48
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 31, 2020 at 19:39

2 Answers 2

Reset to default
3

NAT uses different source ports, usually incrementally, for consecutive packets from the same connection.

That's not true. Please show what you have to demonstrate that. If you use a connection-oriented protocol, like TCP (which is the only connection-oriented transport protocol supported by NAPT), you would see that the connection uses the same TCP port number for the entire duration (every packet) of the connection.

Assume I am pinging an external server from a client on my private network. the client PC sends 3 ICMP echo-request packets. When I check out the NAT translations table on the router, there are 3 entries; from the same source IP address to the same destination IP address but each have a different port number.

Ping uses ICMP which is connectionless, so you do not have connections with ping. Also, ICMP does not use port numbers; it uses Query IDs. Each ICMP echo request sent by ping will use a different Query ID because (to ICMP) it is a different query.

Improve this answer
4
  • I'm trying to figure out how to insert a screenshot. When I connect to a http server, there are a bunch of TCP packets in the NAT table, each having a different port number.
    – 4everlearner
    Commented Aug 9, 2018 at 1:07
  • Just edit your question and use the image feature.. Please do not use images for text, but paste the text into the question and use the Preformatted-text option ({}).
    – Ron Maupin ♦
    Commented Aug 9, 2018 at 1:09
  • But how these Query IDs are generated? Does it some random or consecutive 16bit-numbers?
    – z0lupka
    Commented Feb 1, 2021 at 15:04
  • That is implementation-dependent, which would be off-topic here. You can refer to RFC 5508.
    – Ron Maupin ♦
    Commented Feb 1, 2021 at 15:13
1

In brief, Cisco shows the ICMP ECHO REQUEST sequence number as the "port" in its output, in this case, 2368. As explained by Ron in comments, "Those are ICMP Query IDs, and each ICMP query uses a different Query ID because it is a different query."

gw#show ip nat translations  icmp
Pro Inside global      Inside local       Outside local      Outside global
icmp XXX.YYY.Z.22:2368 192.168.0.28:2368  8.8.8.8:2368       8.8.8.8:2368

This is the packet out, note the ICMP packet id 2368. (Captured on sending host, ie, inside the NAT)

11:25:01.914477 IP (tos 0x0, ttl 64, id 2073, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.28 > 8.8.8.8: ICMP echo request, id 2368, seq 2, length 64

And the reply, note ICMP packet id 2368.

11:25:01.938002 IP (tos 0x0, ttl 120, id 36926, offset 0, flags [none], proto ICMP (1), length 84)
    8.8.8.8 > 192.168.0.28: ICMP echo reply, id 2368, seq 2, length 64
Improve this answer
3
  • Sure! what about TCP?
    – 4everlearner
    Commented Aug 9, 2018 at 17:35
  • 1
    What about it? Each TCP connection gets an entry. It's normal to see many entries for a "single" web fetch, as it will usually reference CSS, javascript, image files.
    – jonathanjo
    Commented Aug 9, 2018 at 17:50
  • I thought that too but this is just a simulated website, part of a cisco networking academy lab. I didn't think it would invoke so many connections.
    – 4everlearner
    Commented Aug 10, 2018 at 2:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.