0

Let's take a classic example.

My computer sends a GET request to stackexchange.com.

Here's how I understand the procedure:

For sending this request, my computer allocates a temporary port for this request, and that's the port where the router will send its response. My router will do the same: it will allocate a temporary port, to which it will expect to get the response from its router.

It goes on and on, each router allocates its own temporary port and forwards the request, until we get to a top router that has both computers under its own NAT, the message will be sent to stackexchange's public IP and it will respond to the top router's temporary port, and each router will forward the message back down to the temporary port in its child router until my computer gets the response.

Then my computer will close the connection, and all the routers will recursively free the port.

Is that really how it works? And if it does, I would expect the top router's port allocation to always be in full capacity. Since it's limited by design to 65K, and the duration of the connection does not depend on it but on the client and server, there's no CPU or memory power that can help it. So how does it actually work?

Improve this question
9
  • First, understand what a port is. It is an address used by some transport protocols (TCP and UDP). Also, understand that TCP port 1234 is not the same port as UDP port 1234. NAPT maintains separate tables for TCP, UDP, and ICMP (uses Query IDs), so there are 65,536 ports each for TCP and UDP.
    – Ron Maupin ♦
    Jul 22, 2019 at 14:23
  • Next, a TCP connection consists of source and destination addresses for both the network (IP) and transport (TCP) protocols. That means a single TCP port can be used by any number of connections (multiplexing) because they will have different source and destination addresses. How do you think a web server listening on TCP port 80 can have many thousands of simultaneous connections?
    – Ron Maupin ♦
    Jul 22, 2019 at 14:25
  • @RonMaupin I think that your 2nd comment is the actual answer. Reusing the same port for different sources actually is a good mitigation for the problem.
    – Yochai
    Jul 22, 2019 at 15:53
  • 1
    @Yochai, you're not understanding how networking works. In most cases, the only router that is doing NAT is your local router. All other routers only forward packets based on IP address -- they do not look at, nor understand ports.
    – Ron Trunk
    Jul 22, 2019 at 16:00
  • You only use NAT where you absolutely must (private/public or overlapping addressing). In most routers, NAT is not used at all, only normal routing, which is based entirely on the IP address, not the transport protocol, which is merely payload to IP.
    – Ron Maupin ♦
    Jul 22, 2019 at 16:06

2 Answers 2

Reset to default
4

That's not how it works. Routers operate at layer 3. They do not process transport layer information (ports), except when performing NAT. That is done by your PC and the server you're connecting to. All the intermediary routers simply forward IP packets to the destination.

Improve this answer
2
  • Still, each router in the hierarchy is behind NAT. So each router gets the response (not to a port?) and needs to know where to forward the response. It still seems to me that that it needs to maintain a table that works in a similar way.
    – Yochai
    Jul 22, 2019 at 12:57
  • 2
    Very few machines between to random internet end points will be doing NAT. (i.e. the originating and terminating ends. with a remote possibility of CGN at the originating ISP end.)
    – Ricky
    Jul 22, 2019 at 15:10
1

each router allocates its own temporary port and forwards the request, until we get to a top router

No, ports are only assigned on your internal router if it perform NAT operation. During forwarding packet over the network other routers do not assign temporary ports on them.

In big environments (data center or something) with servers they can use Virtual IPs so one server could have 5 private ip addresses so this giving possibilities to address 5 times ~64k ports. So this is how it looks like from internal part of the network from external also there is no problem because port allocation contains your IP address and port so on router close to servers they can do translation: your source ip address + your source port to on of 5 local ip addresses of one server. To experience port exhaustion you need to open over 64k connections to one server and still most probably your PC will experience port exhaustion rather than server which can have multiple private IPs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.