0

NATP helps each connection on the client device gain a "temporary identity" on the internet, by maintaining a one-to-one relationship between its local ip-port to a WAN ip-port. The binding cannot be one-to-many or many-to-one because otherwise, packets won't be able to route back from servers to client devices correctly.

But for each single client device, there are many connections at a moment (at most 65535), usually tens to hundreds of. And a router doing NATP is serving thousands of devices. If each connection consumes a port on the router, ports may not be enough. Is that right?

Assuming I have 10 public WAN ips, so my capacity is 10x65535=655350 connections at a moment. I think that's not a big number, because now each person carries many devices, and each device is using the internet in many ways.

If what I said is the case, I think there's a way to do dDOS attack, by deliberately establishing a big number of useless connections and run out of ports.

If there's something wrong about my thinking, please tell me. Thank you.

1
  • IP does not have ports. Some transport protocols, e.g. TCP and UDP, have addresses called ports, but each has its own ports. TCP port 12345 is not UDP port 12345. NAPT (not NATP) has different tables for TCP and UDP, and the table entries have both the source and destination IP and transport addresses, not just the local addresses.
    – Ron Maupin
    Jul 24 at 14:23
4

You're missing a few keys. The index for NAT (or any connection tracking) is the src IP and port plus the dst IP and port. (Some systems even pay attention to TCP sequence numbers.) So a node can open up to 65535 connections to the same dst IP/port -- 192.168.1.1:[1-65535] to (www):80. Change either destination IP or port and it's a different set.

Put another way, there are four variables defining a unique connection: source IP, source port, destination IP, destination port. If the source IP is fixed (router with a single address), there will still be 64k possible source ports for each destination IP + port. So, you could have 6000 nodes open 10 connections to the same website at the same time without running out of ports. (in fact, most systems run out of memory before they run out of ports.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.