NATP helps each connection on the client device gain a "temporary identity" on the internet, by maintaining a one-to-one relationship between its local ip-port to a WAN ip-port. The binding cannot be one-to-many or many-to-one because otherwise, packets won't be able to route back from servers to client devices correctly.
But for each single client device, there are many connections at a moment (at most 65535), usually tens to hundreds of. And a router doing NATP is serving thousands of devices. If each connection consumes a port on the router, ports may not be enough. Is that right?
Assuming I have 10 public WAN ips, so my capacity is 10x65535=655350 connections at a moment. I think that's not a big number, because now each person carries many devices, and each device is using the internet in many ways.
If what I said is the case, I think there's a way to do dDOS attack, by deliberately establishing a big number of useless connections and run out of ports.
If there's something wrong about my thinking, please tell me. Thank you.