0

As I have seen in How does a router know to which PC in a network to send a response from a server? if I haven't misunderstood it, if an interface in a private network sends a Datagram to the outside then the router alocates a port for that connection, everything ok to that point, but I have some questions about the details of it.

  1. How much does this link last? It is allocated for a single petition or it is allocated for an stream of datagrams?
  2. The link between a IP:port of router and an IP:port of host is done at the Data Link level by MAC address or at Network Level by IP address? If it is done at Network Level how does the router prevent answering to another interface in case that the original interface changes its IP in the middle of the conversation?
  3. In the case of a very big private network with more hosts than ports avaliable, how does the router handle the overflow?
| improve this question | |
3
  1. How much does this link last? It is allocated for a single petition or it is allocated for an stream of datagrams?

For a stateful protocol such as TCP, the NAT router can see when the connection is established and when it's closed. To avoid zombified connections the router uses an additional timeout (e.g. TCP aging) to clean up old entries that presumably(!) aren't used any more. Usually, this is between 5 and 60 minutes.

For a stateless protocol such as UDP, the router just relies on its internal timeout (UDP aging). This is usually between 30 seconds and a few minutes. Note that the NAT router can't really know when the connection isn't used any more - premature closing of the connection causes loss of data from the outside.

As @jonathanjo has aptly pointed out, the necessity of aging and eventually deleting a connection is one of the many problems of NAT. In principle, a packet router is supposed to be a stateless device, ie. it matches each ingress packet to its routing table and forwards according to the result - nothing more. NAT requires a router to store, process and clean up considerable amounts of stateful data.

  1. The link between a port and an interface is done at the Data Link level by MAC address or at Network Level by IP address?

You're mixing different layers. A port can mean an interface at the physical layer or a host's subaddress on many transport layer protocols (such as TCP and UDP). A link is established between two physical ports. Transport layer protocols may establish a socket connection.

The whole point is essentially one of multiplexing: a physical port can theoretically transport data for millions of different logical connections in a single second. A transport layer source-destination port pair only stands for a single, logical connection between two applications (e.g. a web browser requests an HTML page from a web server).

after edit

  1. The link between a IP:port of router and an IP:port of host is done at the Data Link level by MAC address or at Network Level by IP address? If it is done at Network Level how does the router prevent answering to another interface in case that the original interface changes its IP in the middle of the conversation?

A NAT (or rather NAPT) router holds a translation table, most basically inside IP:TCP/UDP port ~ outside IP:TCP/UDP port pairs. Translation is done entirely on the network (IP) and the transport layer (TCP, UDP, ...). Ethernet's MAC addresses are completely unrelated.

If it is done at Network Level how does the router prevent answering to another interface in case that the original interface changes its IP in the middle of the conversation?

Actually, it doesn't matter which interface is used to transmit traffic to/from a certain IP address. However, once a logical connection is established, neither IP address can change.

  1. In the case of a very big private network with more hosts than ports avaliable, how does the router handle the overflow?

Large private networks usually don't only use a single public IP address to handle NAT but a pool. Also, ports are dynamically allocated as needed, not statically per host. Additionally, a connection consists of source IP, source port, destination IP, and destination port. A NAT router could therefore use the same source port for different destinations.

| improve this answer | |
  • I have edited the question to clarify the point number two. What I refer is to the link between host and router – Santiago Sánchez Dec 16 '18 at 12:25
  • It's worth noting that one of the reasons NAT is nasty is exactly this question of how long the mapping should last. There is an arms race between the application writers, who want to claim resources and keep the link up by adding all kinds of keepalives (data to make the link still appear live) and the network managers, who try to conserve resources and detect "fake" data to close down not-really-used connections. – jonathanjo Dec 16 '18 at 13:14
  • @jonathanjo Thanks - I've added a note to the answer. – Zac67 Dec 16 '18 at 14:43
  • @SantiagoSánchez I've expanded the answer somewhat, hope it gets a bit clearer. Essentially, you have to look at each OSI layer's function and once you've grasped those, you can look at concepts like NAT. – Zac67 Dec 16 '18 at 14:45
  • Almost all modern routing platforms have some level of stateful tracking, so it's not just "a problem for NAT". Flow records must have an active lifetime -- machines crash, machines get turned off, machines get unplugged. What makes this problematic for NAT is that the information cannot be recreated -- a route cache entry can be rebuilt, even if it's to a different path. – Ricky Dec 16 '18 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.