For example, there are several servers in the local network,,, etc. They are connected to one public IP.

Why does NAT also assign ports to each local IPs that are already distinguishable to forward packets to the internet using PAT?

  • PAT is a Cisco-specific term for the NAPT variant of NAT. There are multiple forms of NAT, but it is NAPT the uses TCP or UDP port numbers and ICMP query IDs to determine to which of the inside addresses the packet belongs. When receiving traffic to the single NAPT outside address, how is the NAPT device to determine to which inside device the traffic is sent? – Ron Maupin Mar 4 '20 at 11:34

The PATing device uses a combination of IP address and port to create a map of unique entries, allowing it to understand what traffic belongs to which device.

The port allocation needs to be able to account for multiple connections to the same service over the same port. This is critical for traffic that uses the same source and destination like NTP.

Consider if you have all three servers set to the same NIST NTP server. If PAT didn't assign a unique port to each flow, you'd end up with: ->PAT->x.x.x.x:123 -> ->PAT->x.x.x.x:123 -> ->PAT->x.x.x.x:123 ->

(where x.x.x.x is your public IP being used for PAT)

The return traffic from NIST would just be -> x.x.x.x:123 for all three flows. How does the PAT device know, based purely off of source/destination IP's and ports, which internal server the return traffic goes to?

By assigning a unique source port during PAT, you end up with something like the following: ->PAT->x.x.x.x:123 -> ->PAT->x.x.x.x:124 -> ->PAT->x.x.x.x:125 ->

Now the return traffic will be destined to a unique port, which the PAT device can untranslate back to the proper source.

This isn't just an issue for 'symmetric' services like NTP. It is entirely feasible that you have multiple clients connecting to the same external server, and eventually two or more collide on their choice of source port.

Also to Ron's point in his comment, this is all very general and the exact implementation depends on the device and the specific type of NAT being employed.

  • So, how does it distinguish which packet originates from if in both cases the traffic would be sent back to How does it know that it should go to PAT->x.x.x.x:124, for example, if the request to the server was sent simultaneously from all 3 hosts? – t7e Mar 4 '20 at 14:18
  • Ah, that's because the destination server is seeing source ports 123, 124, and 125. Those aren't just local to the PAT device, that's what the source ports become when the packets leave the device. – boomi Mar 4 '20 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.