1

As far as I know, a traffic from a NAT router should appear similar to traffic from one computer with a single IP address. If you do not have any access to a network (let's say you are an ISP), can you determine whether the device connected to the network is a single computer or a router performing NAT?

Assume that traffic from all devices behind the NAT is similar enough so it is impossible to know that there are more clients performing the requests.

Improve this question
2
  • 2
    The answer is a "weak yes", but it's at best an educated guess. Port number selection can be a huge clue.
    – Ricky
    Feb 22 at 7:44
  • A router is just another host on the LAN, but it knows how to reach other networks.
    – Ron Maupin ♦
    Feb 22 at 13:30

5 Answers 5

Reset to default
3

IPv4 (OSI network layer) addresses have no distinguishing attributes that would differentiate them between single devices and NAT Devices

Assumptions (summarized from OP): Conclusions

  1. No network access and assumed to be on outside (dirty) side of network. Therefore, snooping packets to see the OSI data-link layer MAC address that would identify a manufacturer is not possible.

An OUI {Organizationally Unique Identifier} is a 24-bit number that uniquely identifies a vendor or manufacturer. They are purchased and assigned by the IEEE. The OUI is basically the first three octets of a MAC address.

  1. Traffic from all devices behind NAT is similar. TTLs in packets from multiple clients behind NAT device could be set to the same initial values and could even match packets initiated by the NAT device itself by chance. Ports used by TCP or UDP in the OSI Transport layer may also be similar enough. No smoking gun here either.

Now it's possible to infer a NAT device is present, but it's not definitive. TTLs mentioned earlier in the network layer tend to get set closer to values that are deterministic vs stochastic based on the device's operating system and version, allowing programs like nmap to make a best-guess on fingerprints from devices.

Improve this answer
1

Yes in my opinion, it is possible to differentiate between a single computer and a NAT router using certain methods. To, differentiate between a single computer and a NAT router include analyzing the TTL (time to live) value of packets and using port scanning techniques to detect the presence of a NAT device.

Improve this answer
0

Via checking the MAC address you can easily determine the brand of device connected to the WAN service. Well, the ISP can anyway. That will help you know about 9/10 times what kind of device it is. From there, you can look at a traffic capture to know a lot more surely how many devices might be generating the traffic on the internet service.

Improve this answer
0

A couple of indications spring to mind.

  1. You can look at the Vendor part of the MAC address, but many vendors make multiple types of device.
  2. You can look at the TTL values of outgoing packets. Most hosts will set the initial TTL to one of a handful of values, if you see a bunch of values that are one less than the widely used initial values then it's a strong indication that a NAT router is in use..
Improve this answer
-2

can you determine whether the device connected to the network is a single computer or a router performing NAT?

Definitely not on the network layer and likely not on the transport layer either (depending on implementation and configuration), which is the upmost, on-topic layer here.

Distinction may be possible on the application layer, but that is explicitly off topic here as are requests for product recommendations, see the help center.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.