If a company of thousands of end points all try to access a specific destination (let's say google.com), then the maximum TCP connections it can have in total is limited to 65535 connections, based on limit of source port ranges. This assumes a simple NAPT that does address and port mapping for all the end points in the private network.

It sounds quite possible this limit would be reached in a large network with many end points running many different clients, all connecting to the same outside network service. What's the solution to this limit?

  • 3
    Large companies will have multiple exit points and use proxies, and probably own blocks of public IPv4 addresses. It is possible to overload the NAPT tables on a device running NAPT, but a large company will have taken measures to avoid that. Do not make the mistake of trying to imagine large companies using consumer-grade equipment or residential ISPs. – Ron Maupin May 4 '20 at 22:45

As Ron points out in the comments, typically larger enterprises won't have all of their outbound traffic sitting behind a single public IP but rather multiple pools of IP's that are often also at multiple gateways.

It's also the case that larger enterprises will often be using various app-level proxies for most outbound web traffic that, again, are typically broken up into different sites and clusters. As a result the NAT gateway/outbound firewalls likely would only see a handful of proxy addresses to be translated. These proxies themselves could have public addresses, or even be a managed service. Direct Internet access via a standard NAT gateway is often only provided on an exception basis, as the proxy approach has a bunch of other wins (caching, content management/security, load management, etc).

It's worth noting that even in the case of direct NAT there are usually fairly aggressive timeouts in place to recycle source ports.

Finally, ephemeral source ports can actually potentially be reused. Each socket is the tuple of (srcaddr, srcport, dstaddr, dstport, protocol). If any of those values changes, it's a different socket. In the NAT case, the same source port could theoretically be in use by multiple translations as long as there was other disambiguating information. So, for example, one session could be (Host-A, Port A, RemoteHost B, Port-B, TCP) translated to (NAT GW Addr, port-C, RemoteHost B, Port-B, TCP) while a session from another internal host to a different remote IP used the same ephemeral source on the NAT gateway.

Now...whether a given host OS or firewall implementation would bother reusing ephemeral sources this way? It's going to depend on the specific implementation. The key point is that the namespace is actually a lot larger than your question suggests.


The 65535 is only the source/destination port. Flows are formed out of the 5-tuple. src-ip, dst-ip, src port, dst port, protocol. As you can seem the combinations are much larger.

Secondly, NAT operations through a flow table. THe size of the flow table determines how many flows can be kept alive simultaneously.

Third, most connections are not persistent. They are transactional. So they are short lived and can be ejected off the table if required. THe flow table acts like a cache. If the NAT detects a flow, it checks the table and if it is there, it forwards the packets based on the information. If not, it creates a new flow. Creating a new flow increases the latency a bit, but it is not the end of the world. The flow will still make it to the end point and the transaction will complete.

  • 1
    src-ip (my ip), dst-ip (their ip), dst-port (80, 443), and protocol (ip) will always be the same. The only thing that changes is the src-port, hence the 65k limit -- in many cases less. When you hit that limit, no new connections can be formed. – Ricky May 5 '20 at 13:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.