NAT Port Table: Address Translation & Exhaustion |…

What is NAT Port Table?

Network Address Translation (NAT) is a technique used by routers to manage external connections from internal hosts on a private network. The NAT port table tracks which external ports are allocated to each internal host, allowing them to communicate with the internet while conserving public IP addresses.

This system involves translating internal IP addresses and ports into different values for external communication.

How Does Port Exhaustion Occur?

Port exhaustion happens when all available external ports in the NAT pool are allocated, preventing new connections from being established. This can occur under heavy load or with a limited port-pool size.

The Erlang-B formula is often used to model and predict the probability of port exhaustion based on the number of active sessions and the total number of available ports.

live demo · related simulation● LIVE

Types of NAT Modes

There are several types of NAT modes, but Full-Cone and Symmetric NAT are particularly relevant. In a Full-Cone NAT mode, any external host can send data to an internal host as long as the internal host has previously initiated a connection.

Symmetric NAT is more restrictive; it requires that both the source IP address and port must match those used in a previous request from the same internal host.

Impact of Unsolicited Inbound Packets

Unsolicited inbound packets are silently dropped if there is no matching entry in the NAT table, which can lead to communication failures and security vulnerabilities.

This behavior ensures that only legitimate connections are allowed from external hosts, enhancing network security but potentially disrupting services.

Frequently asked questions

What causes port exhaustion in a NAT router?

Port exhaustion occurs when all available external ports in the NAT pool are allocated to internal hosts, preventing new connections from being established under heavy load.

How can I prevent port exhaustion in my network?

To avoid port exhaustion, ensure that your NAT router has a sufficiently large port-pool size and consider optimizing the average session hold time to reduce the number of active sessions.

What is the difference between Full-Cone and Symmetric NAT modes?

In Full-Cone NAT mode, any external host can send data to an internal host as long as it has previously initiated a connection. In Symmetric NAT mode, both the source IP address and port must match those used in a previous request from the same internal host.

Why do unsolicited inbound packets get dropped by NAT routers?

Unsolicited inbound packets are dropped to prevent unauthorized access and ensure that only legitimate connections are allowed, enhancing network security but potentially disrupting services if not properly managed.

Try it live

Everything above runs in your browser — open NAT Port Table: Address Translation & Exhaustion and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.

▶ Open NAT Port Table: Address Translation & Exhaustion simulation