IP NAT Port-Based ("Overloaded") Operation: Network Address Port Translation (NAPT) / Port Address Translation (PAT)
(Page 1 of 2)
Both traditional NAT and bidirectional NAT work by swapping inside network and outside network addresses as needed to allow a private network to access a public one. For each transaction, there is a one-to-one mapping between the inside local address of a device on the private network, and the inside global address that represents it on the public network. We can use dynamic address assignment to allow a large number of private hosts to share a small number of registered public addresses.
However, there is a potential snag here. Consider our earlier NAT example, where 250 hosts share 20 inside global (public) addresses. If 20 hosts already have transactions in progress, what happens when the 21st tries to access the Internet? There aren't any inside global addresses available for it to use, so it won't be able to.
Fortunately, there is a mechanism already built into TCP/IP that can help us alleviate this situation. The two TCP/IP transport layer protocols, TCP and UDP, both make use of additional addressing components called ports. The port number in a TCP or UDP message helps identify individual connections between two addresses. It is used to allow many different applications on a TCP/IP client and server to talk to each simultaneously, without interference. For example, you use this capability when you open multiple browser windows to access more than one Web page on the same site at the same time. This sharing of IP addresses amongst many connections is called multiplexing. The section on TCP and UDP ports describes all of this in much more detail.
Now, let's come back to NAT. We are already translating IP addresses as we send datagrams between the public and private portions of the internetwork. What if we could also translate port numbers? Well, we can! The combination of an address and port uniquely identifies a connection. As a datagram passes from the private network to the public one, we can change not just the IP address but also the port number in the TCP or UDP header. The datagram will be sent out with a different source address and port. The response will come back to this same address and port combination (called a socket) and can be translated back again.
This method goes by various names. Since it is a technique whereby we can have multiple inside local addresses share a single inside global address, it is called overloading of an inside global address, or alternately, just overloaded NAT. More elegant names that better indicate how the technique works include Port-Based NAT, Network Address Port Translation (NAPT) and Port Address Translation (PAT).
Whatever its name, the use of ports in translation has tremendous advantages. It can allow all 250 hosts on our private network to use only 20 IP addressesand potentially even fewer than that. In theory you could even have all 250 share a single public IP address at once! You don't want to share so many local hosts that you run out of port numbers, but there are thousands of port numbers to choose from.
Port-based NAT of course requires a router that is programmed to make the appropriate address and port mappings for datagrams as it transfers them between networks. The disadvantages of the method include this greater complexity, and also more potential compatibility issues (such as with applications like FTP) since we must now watch for port numbers at higher layers and not just IP addresses.
Home - Table Of Contents - Contact Us
The TCP/IP Guide (http://www.TCPIPGuide.com)
Version 3.0 - Version Date: September 20, 2005
© Copyright 2001-2005 Charles M. Kozierok. All Rights Reserved.
Not responsible for any loss resulting from the use of this site.