I have tried packet tracer and actual cisco routers and I find this weird: NAT uses different source ports, usually incrementally, for consecutive packets from the same connection. Why is that?

Assume I am pinging an external server from a client on my private network. the client PC sends 3 ICMP echo-request packets. When I check out the NAT translations table on the router, there are 3 entries; from the same source IP address to the same destination IP address but each have a different port number. Shouldn't there be just one entry? BTW, that is the case with different kinds of NAT including dynamic NAT and PAT.

This is taken from a cisco academy lab.

  • 2
    ICMP packets don’t have port numbers. – Ron Trunk Aug 8 at 18:50
  • I know that ICMP doesn't use port numbers. I'm using NAT terminology. What do you call the number after the colon and the IP_add in the translation table (33 - 35 in the following example)? Pro Inside global Inside local Outside local Outside global icmp 209.165.200.225:33192.168.1.20:33 209.165.201.17:33 209.165.201.17:33 icmp 209.165.200.225:34192.168.1.20:34 209.165.201.17:34 209.165.201.17:34 icmp 209.165.200.225:35192.168.1.20:35 209.165.201.17:35 209.165.201.17:35 – 4everlearner Aug 9 at 0:54
  • 1
    Those are ICMP Query IDs, and each ICMP query uses a different Query ID because it is a different query. ICMP, as a connectionless protocol, doesn't have connections, so each ICMP query stands on its own. Ping is an application that usually sends several ICMP queries, but ICMP doesn't relate those queries to each other. They must be separate so that the replies to the Query ID do not get mixed up with the other queries. – Ron Maupin Aug 9 at 1:13
  • "I'm using NAT terminology." Actually, no, you are not. There is an RFC for proper NAT terminology: RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, where you will find things like NAPT, but not PAT, and it will explain about ICMP Query IDs. – Ron Maupin Aug 9 at 13:48

NAT uses different source ports, usually incrementally, for consecutive packets from the same connection.

That's not true. Please show what you have to demonstrate that. If you use a connection-oriented protocol, like TCP (which is the only connection-oriented transport protocol supported by NAPT), you would see that the connection uses the same TCP port number for the entire duration (every packet) of the connection.

Assume I am pinging an external server from a client on my private network. the client PC sends 3 ICMP echo-request packets. When I check out the NAT translations table on the router, there are 3 entries; from the same source IP address to the same destination IP address but each have a different port number.

Ping uses ICMP which is connectionless, so you do not have connections with ping. Also, ICMP does not use port numbers; it uses Query IDs. Each ICMP echo request sent by ping will use a different Query ID because (to ICMP) it is a different query.

  • I'm trying to figure out how to insert a screenshot. When I connect to a http server, there are a bunch of TCP packets in the NAT table, each having a different port number. – 4everlearner Aug 9 at 1:07
  • Just edit your question and use the image feature.. Please do not use images for text, but paste the text into the question and use the Preformatted-text option ({}). – Ron Maupin Aug 9 at 1:09

In brief, Cisco shows the ICMP ECHO REQUEST sequence number as the "port" in its output, in this case, 2368. As explained by Ron in comments, "Those are ICMP Query IDs, and each ICMP query uses a different Query ID because it is a different query."

gw#show ip nat translations  icmp
Pro Inside global      Inside local       Outside local      Outside global
icmp XXX.YYY.Z.22:2368 192.168.0.28:2368  8.8.8.8:2368       8.8.8.8:2368

This is the packet out, note the ICMP packet id 2368. (Captured on sending host, ie, inside the NAT)

11:25:01.914477 IP (tos 0x0, ttl 64, id 2073, offset 0, flags [DF], proto ICMP (1), length 84)
    192.168.0.28 > 8.8.8.8: ICMP echo request, id 2368, seq 2, length 64

And the reply, note ICMP packet id 2368.

11:25:01.938002 IP (tos 0x0, ttl 120, id 36926, offset 0, flags [none], proto ICMP (1), length 84)
    8.8.8.8 > 192.168.0.28: ICMP echo reply, id 2368, seq 2, length 64
  • Sure! what about TCP? – 4everlearner Aug 9 at 17:35
  • What about it? Each TCP connection gets an entry. It's normal to see many entries for a "single" web fetch, as it will usually reference CSS, javascript, image files. – jonathanjo Aug 9 at 17:50
  • I thought that too but this is just a simulated website, part of a cisco networking academy lab. I didn't think it would invoke so many connections. – 4everlearner Aug 10 at 2:19

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.