Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If several computers with local addresses (192.168.0.#) are connected to a router and each computer opens a web browser and requests a page over HTTP, when these TCP:80 packets are sent out, the router switches the local address with the static IP of the router (i.e. Provider given IP) so the server can reply to the appropriate address.

But how does the router know to which computer to forward the HTTP reply, since the TCP header does not contain the local IP address (does it?), and all computers are using port 80?

Does this have anything to do with the MAC addresses?

How exactly does this work?

share|improve this question

3 Answers 3

up vote 34 down vote accepted

Most home routers use a special-case of NAT called PAT.

You'll also see it referred to as NAPT, or IP Masquerading. All three of the latter terms mean the same thing in general use. (The acronyms - Network Address Translation / Port Address Translation / Network Address Port Translation)

When the packet goes out from your internal machine, the source address is rewritten as you are aware. The source port is also changed, usually to a high number, and the router keeps an address translation table.

For example, let's say you have a client machine that goes to www.google.com. Your computer (e.g., 192.168.1.100) looks that address up and makes a TCP connection to 72.14.204.147 on port 80 from your internal IP address, using a random source port.

To your computer, the connection looks like this:

192.168.1.100:37641   <-->  72.14.204.147:80

Your computer sends the packet to the router, which picks a new random high port and rewrites the packet. Each outbound connection gets its own port on the router. The router then forwards the packet on to your ISP after adding it to its connection table:

PrivateIP        PrivatePort   PublicIP      PublicPort    Remote          RemotePort
-------------    ----------    -----------   -----------   ----------      -----------
192.168.1.100    37641         *10.6.23.5    59273         72.14.204.147   80

*For example purposes, I used an address starting with 10, but these aren't publicly routable. The table is also somewhat oversimplified.

To google, the connection looks like this:

10.6.23.5:59273   <-->  72.14.204.147:80

Google will send it's reponse to 10.6.23.5 on port 59273. Your router then looks up that information in the table and forwards the packet on to 192.168.1.100:37641.

share|improve this answer
1  
So to summarize, the Router uses port numbers to remember what from the outside the local network goes to what on the inside of the network. However, this doesn't explain how it www.google.com would find me if I didn't send it an initial request. In other words, messages can only reach me via the router if I initially sent a request through the router –  Imray Jun 26 '14 at 15:15
1  
@Imray google.com (or anything else on the Internet) can't find your computer if your computer didn't initiate the request. This is why having a router adds a lot of security. –  Jason Jul 22 '14 at 18:27
1  
@Jason That's a dangerous myth. Having a firewall adds security. The job of a typical SoHo router is just to make things work, not to stop things from working. Se here for more information. –  David Schwartz Jul 22 '14 at 18:38
1  
Nice example, but does this mean all high number ports are always open on our routers? –  jiggunjer Feb 15 at 15:15
1  
No. Often, the NAT feature is more a function of the firewall code within the router than the regular networking functionality. The port won't be in a LISTEN state or accept new connections, but once the mapping is there, it may or may not allow other inbound packets to use that mapping; Newer systems will usually only allow packets in from the actual system you initiated the connection to. A few exceptions to that rule: 1) Special handling to support FTP connections will open ports; 2) UPnP devices may request an inbound port; 3) You manually configured port forwarding for a given protocol. –  Paul Feb 16 at 22:40

The routers between the local network and the rest of the internet use a technique called NAT.

Just an excerpt from TCP/IP Illustrated Volume 1 about NAPT, with a word about the shortcomings of its simple cousin, Basic NAT:

Basic NAT performs rewriting of IP addresses only. In essence, a private address is rewritten to be a public address, often from a pool or range of public addresses supplied by an ISP. This type of NAT is not the most popular because it does not help to dramatically reduce the need for IP addresses—the number of globally routable addresses must equal or exceed the number of internal hosts that wish to access the Internet simultaneously. A much more popular approach, NAPT involves using the transport-layer identifiers (i.e., ports for TCP and UDP, query identifiers for ICMP) to differentiate which host on the private side of the NAT is associated with a particular packet (see Figure 7-4). This allows a large number of internal hosts (i.e., multiple thousands) to access the Internet simultaneously using a limited number of public addresses, often only a single one. We shall ordinarily use the term NAT to include both traditional NAT and NAPT unless the distinction is important in a particular context.

share|improve this answer

The router uses something called NAT (Network Address Translation).

share|improve this answer
14  
oddly enough, even though the question doesn't name it, more of how it works is explained in the question than this "answer" does. please consider expanding your answer to provide an overview of how NAT works. links to source material are encouraged, but we do like to see actual answers rather than links offsite. –  quack quixote Feb 7 '10 at 13:40
    
Well, I guess the link to the NAT wiki is ok. Specific answer would surely make understanding easier and require less time, but I got my answer... :) –  Kornelije Petak Feb 7 '10 at 13:53
    
The question is actually more complicated than it may appear, especially when you consider multiple routers/switches on the same LAN. The ideal answer would mention domain controller elections and multicasting, imo. But yes, "NAT" does essentially answer the question. –  RJFalconer Feb 7 '10 at 15:30
3  
@BlueNovember: do "domain controller elections" have anything to do with basic TCP/IP routing? cause they don't on my networks. –  quack quixote Feb 7 '10 at 15:39
1  
@BlueNovember: as i understand it they're a part of WINS/NetBIOS/SMB protocols, not TCP/IP. admittedly i've only dealt with them when configuring Samba to win them over win2k/XP. –  quack quixote Feb 7 '10 at 19:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.