I had a practice question about a NAT-enabled router with outside address and inside network 192.168.1/24 and three inside hosts .1, .2 and .3. The three hosts all open two connections to port 80.

The NAT table of the router was given as

    NAT Translation Table
      WAN Side                      LAN Side, 4000, 3345, 4001, 3346, 4002, 3445, 4003, 3446, 4004, 3545, 4005, 3546

My question is regarding the answer. I understand the IP addresses. However, are the port numbers randomly chosen or does the order of 3345, 3346, 3445, etc. have a sort of logic given behind them?

What are the requirements on hosts and routers choosing port numbers for this situation?

Is there any reason the WAN-side port numbers couldn't be 6000 to 6005, for example? Or the LAN-side port numbers be 1234 to 1239?

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Ron Maupin
    Dec 13, 2018 at 23:07
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Dec 19, 2020 at 22:29

2 Answers 2


Outgoing port numbers in general are basically extremely unpredictable. Port numbers are only strictly applicable to TCP and UDP, but ICMP "identifier" fields can work in the same way as regards NAT.

There are a few protocols where the outgoing call has to come from a particular port number, but the most common operating systems's mplementations choose ports from a range for this purpose.

RFC 6335 covers this:

the System Ports, also known as the Well Known Ports, from 0-1023 (assigned by IANA), the User Ports, also known as the Registered Ports, from 1024-49151 (assigned by IANA), the Dynamic Ports, also known as the Private or Ephemeral Ports, from 49152-65535 (never assigned)

Some operating systems choose the ports randomly from a range, some choose them in linear order (like you see in your example). Some choose lowest available number from a range. It's entirely up to the operating system. Some operating systems let you choose the ranges. (A system with a great deal of outgoing connections, perhaps a web proxy, a mail gateway, or a NAT device, might run out of port numbers if the range is too small.)

In common speaking, many people just say some random high port number.

In your case, the WAN-side port numbers are chosen by the NAT devices. The LAN-side port numbers are chosen by the three hosts .1, .2 and .3, but note that it would be extraordinarily unusually for three hosts to choose the idential two port numbers for outgoing connections without something enforcing it. (Running in sync is unlikely to do it -- a transient failure with a retry, for example, will "use up" a port number in whatever sequence the OS is using.)

As Eddie says:

A lot of Cisco router's will choose Source Ports sequentially. A lot of F5 devices choose Source ports randomly. Every vendor is free to do it their own way.

A point to notice is that if you are planning access control on port numbers, you might have to accomodate whatever your operating systems use.

If for some reason you need to control particular port numbers for outgoing NAT, you need "static PAT" in your NAT device.


What are the requirements on hosts and routers choosing port numbers for this situation?

How a device chooses the port numbers for the NAPT translations is not defined in the standard. The actual implementation is up to the device manufacturer. Some vendors will use sequential port numbers, and some will use random port numbers; how it is implemented is completely up to a manufacturer.

You, as an end-user, will not have control over the dynamic allocation of the ports, but, depending on the device, you may be able to implement port forwarding.

It is also important to understand that each of the protocols (TCP, UDP, and ICMP) that can use NAPT will each have a separate translation table. ICMP does not use ports (transport addresses) the way that TCP and UDP do, and that while TCP and UDP use port numbers in the same numeric range, they are different ports, even if the port number is the same (TCP port 9876 is not UDP port 9876, and vice versa). ICMP has Query IDs rather than ports.

  • "ICMP has Query IDs rather than ports." plus ICMP error messages include the IP and transport layer headers. So, the NAT router can mostly figure out where to forward the error message to.
    – Zac67
    Dec 17, 2018 at 18:55
  • @RonMaupin NAT table in router how using TCP, UDP port number because in layer3, layer4 information isn't available?
    – S. M.
    Feb 11, 2022 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.