Port Address Translation

---

Hey everyone,

I'm sure this has been addressed at some point, but I was driving home and thinking about port address translation. I know that the router assigns each device on the network a private IP address. When that device wants to make a connection out on the Internet, the router assigns that device a port to then transmit out to the Internet. Is there a logical port assignment for this sort of communication? I was thinking about how the technology would work when there are two devices transmitting over the same protocol or service. Say, for example, that two devices wanted to use Port 443 for HTTPS. How does this work at the router? Does the router then use a different port for that connection?

Hopefully this question makes sense. Thanks for the help!

@kelly-mccormick,

Great question!

You've got the basics down and now you're getting into the details of how connections works. So here's some of the details using your scenario...

• When you have a computer that wants to communicate to a secured web server, you must think about the elements that are involved:

  • Source: IP address and Source Port number
  • Destination: IP address and Destnation Port number
  • Each session must be unique ( Source to Destination)

• When a single computer sends (source), the NAT server (usually a router) generates a dynamic port and attaches it to the sending IP. Also it adds a static port to the destination IP address. Every packet that is sent from single IP, a new dynamic port number is assigned (usually incrementing but not necessarily sequentially) but the destination IP address and port will remain the same.

• When a second computer tries to communicate with the same server using 443 as the destination port but with a different source IP and source Port number. This keeps every connection (session) separate.

• When the server replies from port 443, it is a reply back to the Public IP address with the Dynamic Port. The NAT server will translate the it back into the Private IP address with the Dynamic Port so the connection gets to the right computer.

Let me know if this isn't clear... I'll try and draw up a diagram to help.

Ronnie,

That makes perfect sense. I guess the gap in my knowledge was differentiating between source ports and destination ports. Moreover, I was curious about how the router determines what port to dynamically assign to the packet. Thanks for the clarification!

@kelly-mccormick,

Glad to help...

Technically, according to RFC on port numbers, the Dynamic Ports are supposed to begin at 49152 to 65535. That means that a source address when sending should begin with something like 192.168.1.120: 49152, then 49.153, 49,154, ... etc.

But the reality is that I've seen it as low as 5000 (e.g. 192.168.1.120:5001) Usually, any unused port is available. (see below)

tcp      133      0 Ronnie-Galago-Pro:53376 sea15s11-in-f170.:https CLOSE_WAIT 
tcp      133      0 Ronnie-Galago-Pro:53380 sea15s11-in-f170.:https CLOSE_WAIT 
tcp       32      0 Ronnie-Galago-Pro:44232 162.125.4.4:https       CLOSE_WAIT 
tcp        0      0 Ronnie-Galago-Pro:53578 sea15s11-in-f14.1:https ESTABLISHED
tcp        0      0 Ronnie-Galago-Pro:40444 ph-in-f188.1e100.n:5228 ESTABLISHED
tcp      133      0 Ronnie-Galago-Pro:53372 sea15s11-in-f170.:https CLOSE_WAIT 
tcp        0      0 Ronnie-Galago-Pro:46098 pc-in-f189.1e100.:https ESTABLISHED
tcp      133      0 Ronnie-Galago-Pro:53374 sea15s11-in-f170.:https CLOSE_WAIT 
tcp        0      0 Ronnie-Galago-Pro:37168 economy.canonical.:http TIME_WAIT  
tcp       32      0 Ronnie-Galago-Pro:38788 162.125.5.3:https       CLOSE_WAIT 
tcp        0      0 Ronnie-Galago-Pro:46612 162.125.34.129:https    ESTABLISHED
tcp        0      0 Ronnie-Galago-Pro:38094 162.243.56.130:https    ESTABLISHED
tcp      133      0 Ronnie-Galago-Pro:53378 sea15s11-in-f170.:https CLOSE_WAIT

Look above at my source port numbers