I followed from this question and @PeterGreen's Answer , and come to know that NAT router working in layer3, but using layer4 contents(layer4 port number,layer4 checksum). My question is when layer3 using layer4 contents it breaks the IPv4 datagram to know port number etc. ?

And second question is after layer4 port number translation at NAT router in layer3, new layer4 checksum calculation is also happening in layer3?

  • You might want to check out OSI layering first: networkengineering.stackexchange.com/questions/6380/…
    – Zac67
    Feb 11, 2022 at 21:48
  • @Zac67 I understand osi layer. But when router working in layer3 ,how to use layer4 contents?
    – S. M.
    Feb 11, 2022 at 21:50
  • NAT is not routing, and routers do not NAT. NAT is a process that is often convenient to run on the network edge where there is a router or firewall, but routing does not require NAT, nor does NAT require a router.
    – Ron Maupin
    Feb 11, 2022 at 23:11
  • @AlokMaity As I explained the last time you asked this same question, NAT doesn’t fit into the OSI model. Also when we say something operates at layer X, we’re talking about an idealized device. Real routers have other features beyond just layer 3 routing.
    – Ron Trunk
    Feb 11, 2022 at 23:13
  • @RonMaupin, RonTrunk in one router parallely NAT process and routing is possible?
    – S. M.
    Feb 11, 2022 at 23:20

3 Answers 3


Nat is to put it politely a cross layer process, or to put it less politely a blatant layering violation.

There is a saying about models, "all models are wrong, some models are useful". Models are a useful tool to break down problems and aid understanding, but you should not expect reality to perfectly conform to your model.

On the subjet of OSI, networking vendors like to use the OSI layer numbers, but it's important to realise that the real world networking protocols we use today were not generally designed to conform to the OSI model.

It's also important to realise that networking standards mostly concern themselves with stuff that can be seen on the wire. What exactly happens inside a computer or middlebox is mostly the concern of an individual implementer.

The IPv4 header contains a "protocol" field which carries the protocol number of the transport protocol in use. This is intended for use by the end host receiving the packet, but a NAT (or L4 aware firewall) will also use it to identify the transport protocol that is in use.

For the most common transport protocols, TCP, UDP and ICMP the NAT will certainly have protocol-specific implementations for extraction and translation of packet data. For TCP and UDP it will know how to extract/modify the port numbers and how to recalculate the checksums to take account of the new IP addresses and ports.

ICMP traffic that can be handled by NATs is generally divided into two categories. Query/Response and Errors. Query/response messages can be handled in a similar way to TCP and UDP packets, treating the Type/Code and Identifier fields in a similar way to port numbers. Error messages are handled by extracting internal headers of the "context" packet and translating them.

It's worth noting that while the NAT has to be aware of some transport layer fields, the NAT process does not have to fully implement the transport protocol. It is very likely that the implementation of NAT and firewalling for a particular protocol will be separate from the regular implementation of that protocol and a middlebox may have NAT and firewalling support for protocols that it does not have support for acting as an end host for.

  • @PeterGreen NAT router maintain table which has port no,and corresponding ip address at layer3 or layer4?
    – S. M.
    Feb 12, 2022 at 6:22
  • @PeterGreen why NAT router has necessity to know protocol field about what protocol using in L4? When it extracts the IP datagram it already comes to know the everything details of L4.
    – S. M.
    Feb 12, 2022 at 6:43

My question is when layer3 using layer4 contents it breaks the IPv4 datagram to know port number etc. ? doesn't really make sense.

NAPT translates a privateSourceIP-privateSourcePort to a publicSourceIP-publicSourcePort tuple on egress and reverses that translation for returning packets/segments/datagrams.

The source port may or may not change. The IP address is part of the IPv4 header. The port number is part of the TCP or the UDP header. All checksums need to get fixed.

  • I need to confirm that in layer3, layer4's header is data.My question is layer3 header use layer4 header in layer3?
    – S. M.
    Feb 11, 2022 at 22:05
  • That's why I pointed out the OSI question: L4 uses L3 for transport, so the L4 datagram is L3's payload. But neither layer uses the header of another layer. It's just NAPT messing with both.
    – Zac67
    Feb 11, 2022 at 22:09
  • that's I am asking. You mean only Napt use the L4 header. My question is how Napt come to know layer4 contents by staying in layer3?
    – S. M.
    Feb 11, 2022 at 22:13
  • NAPT uses both layers 3 and 4 and changes headers in both layers (at least potentially).
    – Zac67
    Feb 11, 2022 at 22:16
  • You mean Napt router has L4? And new L4 checksum are calculated in L3 then deliver to L4 or checksum are calculated in L4?
    – S. M.
    Feb 11, 2022 at 22:23

First of all, the OSI model is just a reference model used to understand the different layers, their roles and the separation of concerns.

In practice we don't have to have all the layers, for instance an application layer could use directly the data link layer (if the services of the transport and network layers are not required). It happens that some industrial data networks like Profibus and HART follow this pattern.

This to say, that boundaries between layers are just theoretical and in practice we can easily build cross-layer functions.

Furthermore, On some systems, IP, TCP, and UDP checksums are calculated on the NIC just before they're transmitted on the wire (checksum offloading) and on such systems NAT function doesn't even care about recalculating those checksums

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.