Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If several computers with local addresses (192.168.0.#) are connected to a router and each computer opens a web browser and requests a page over HTTP, when these TCP:80 packets are sent out, the router switches the local address with the static IP of the router (i.e. Provider given IP) so the server can reply to the appropriate address.

But how does the router know to which computer to forward the HTTP reply, since the TCP header does not contain the local IP address (does it?), and all computers are using port 80?

Does this have anything to do with the MAC addresses?

How exactly does this work?

share|improve this question

3 Answers 3

up vote 26 down vote accepted

Most home routers use a special-case of NAT called PAT.

You'll also see it referred to as NAPT, or IP Masquerading. All three of the latter terms mean the same thing in general use. (The acronyms - Network Address Translation / Port Address Translation / Network Address Port Translation)

When the packet goes out from your internal machine, the source address is rewritten as you are aware. The source port is also changed, usually to a high number, and the router keeps an address translation table.

For example, let's say you have a client machine that goes to www.google.com. Your computer (e.g., looks that address up and makes a TCP connection to on port 80 from your internal IP address, using a random source port.

To your computer, the connection looks like this:   <-->

Your computer sends the packet to the router, which picks a new random high port and rewrites the packet. Each outbound connection gets its own port on the router. The router then forwards the packet on to your ISP after adding it to its connection table:

PrivateIP        PrivatePort   PublicIP      PublicPort    Remote          RemotePort
-------------    ----------    -----------   -----------   ----------      -----------    37641         *    59273   80

*For example purposes, I used an address starting with 10, but these aren't publicly routable. The table is also somewhat oversimplified.

To google, the connection looks like this:   <-->

Google will send it's reponse to on port 59273. Your router then looks up that information in the table and forwards the packet on to

share|improve this answer
So to summarize, the Router uses port numbers to remember what from the outside the local network goes to what on the inside of the network. However, this doesn't explain how it www.google.com would find me if I didn't send it an initial request. In other words, messages can only reach me via the router if I initially sent a request through the router –  Imray Jun 26 '14 at 15:15
AFAIK, NAPT and PAT and IP Masquerading are the same colloquially and technically. And they are cases of NAT. With NAT there is rfc-editor.org/rfc/rfc2663.txt traditional NAT, basic NAT and NAPT. –  barlop Jun 26 '14 at 16:25
@Imray google.com (or anything else on the Internet) can't find your computer if your computer didn't initiate the request. This is why having a router adds a lot of security. –  Jason Jul 22 '14 at 18:27
@Jason That's a dangerous myth. Having a firewall adds security. The job of a typical SoHo router is just to make things work, not to stop things from working. Se here for more information. –  David Schwartz Jul 22 '14 at 18:38
@David Schwartz I read your link, the comments, and the chat. While educational, it's not really helpful in practice or in the context of this question. As you said yourself, home/SOHO routers don't purely use NAT. So again, if you have a router, the internet won't be initiating requests with your PC. –  Jason Jul 23 '14 at 18:24

The routers between the local network and the rest of the internet use a technique called NAT.

Just an excerpt from TCP/IP Illustrated Volume 1 about NAPT, with a word about the shortcomings of its simple cousin, Basic NAT:

Basic NAT performs rewriting of IP addresses only. In essence, a private address is rewritten to be a public address, often from a pool or range of public addresses supplied by an ISP. This type of NAT is not the most popular because it does not help to dramatically reduce the need for IP addresses—the number of globally routable addresses must equal or exceed the number of internal hosts that wish to access the Internet simultaneously. A much more popular approach, NAPT involves using the transport-layer identifiers (i.e., ports for TCP and UDP, query identifiers for ICMP) to differentiate which host on the private side of the NAT is associated with a particular packet (see Figure 7-4). This allows a large number of internal hosts (i.e., multiple thousands) to access the Internet simultaneously using a limited number of public addresses, often only a single one. We shall ordinarily use the term NAT to include both traditional NAT and NAPT unless the distinction is important in a particular context.

share|improve this answer

The router uses something called NAT (Network Address Translation).

share|improve this answer
oddly enough, even though the question doesn't name it, more of how it works is explained in the question than this "answer" does. please consider expanding your answer to provide an overview of how NAT works. links to source material are encouraged, but we do like to see actual answers rather than links offsite. –  quack quixote Feb 7 '10 at 13:40
Well, I guess the link to the NAT wiki is ok. Specific answer would surely make understanding easier and require less time, but I got my answer... :) –  Kornelije Petak Feb 7 '10 at 13:53
The question is actually more complicated than it may appear, especially when you consider multiple routers/switches on the same LAN. The ideal answer would mention domain controller elections and multicasting, imo. But yes, "NAT" does essentially answer the question. –  RJFalconer Feb 7 '10 at 15:30
@BlueNovember: do "domain controller elections" have anything to do with basic TCP/IP routing? cause they don't on my networks. –  quack quixote Feb 7 '10 at 15:39
@BlueNovember: as i understand it they're a part of WINS/NetBIOS/SMB protocols, not TCP/IP. admittedly i've only dealt with them when configuring Samba to win them over win2k/XP. –  quack quixote Feb 7 '10 at 19:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.