Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If several computers with local addresses (192.168.0.#) are connected to a router and each computer opens a web browser and requests a page over HTTP, when these TCP:80 packets are sent out, the router switches the local address with the static IP of the router (i.e. Provider given IP) so the server can reply to the appropriate address.

But how does the router know to which computer to forward the HTTP reply, since the TCP header does not contain the local IP address (does it?), and all computers are using port 80?

Does this have anything to do with the MAC addresses?

How exactly does this work?

share|improve this question
add comment

2 Answers

up vote 18 down vote accepted

Most home routers use a special-case of NAT called PAT.

You'll also see it referred to as NAPT, or IP Masquerading. All three of the latter terms mean the same thing in general use. (The acronyms - Network Address Translation / Port Address Translation / Network Address Port Translation)

When the packet goes out from your internal machine, the source address is rewritten as you are aware. The source port is also changed, usually to a high number, and the router keeps an address translation table.

For example, let's say you have a client machine that goes to www.google.com. Your computer (e.g., looks that address up and makes a TCP connection to on port 80 from your internal IP address, using a random source port.

To your computer, the connection looks like this:   <-->

Your computer sends the packet to the router, which picks a new random high port and rewrites the packet. Each outbound connection gets its own port on the router. The router then forwards the packet on to your ISP after adding it to its connection table:

PrivateIP        PrivatePort   PublicIP      PublicPort    Remote          RemotePort
-------------    ----------    -----------   -----------   ----------      -----------    37641         *    59273   80

*For example purposes, I used an address starting with 10, but these aren't publicly routable. The table is also somewhat oversimplified.

To google, the connection looks like this:   <-->

Google will send it's reponse to on port 59273. Your router then looks up that information in the table and forwards the packet on to

share|improve this answer
add comment

The router uses something called NAT (Network Address Translation).

share|improve this answer
oddly enough, even though the question doesn't name it, more of how it works is explained in the question than this "answer" does. please consider expanding your answer to provide an overview of how NAT works. links to source material are encouraged, but we do like to see actual answers rather than links offsite. –  quack quixote Feb 7 '10 at 13:40
Well, I guess the link to the NAT wiki is ok. Specific answer would surely make understanding easier and require less time, but I got my answer... :) –  Kornelije Petak Feb 7 '10 at 13:53
The question is actually more complicated than it may appear, especially when you consider multiple routers/switches on the same LAN. The ideal answer would mention domain controller elections and multicasting, imo. But yes, "NAT" does essentially answer the question. –  RJFalconer Feb 7 '10 at 15:30
@BlueNovember: do "domain controller elections" have anything to do with basic TCP/IP routing? cause they don't on my networks. –  quack quixote Feb 7 '10 at 15:39
@BlueNovember: as i understand it they're a part of WINS/NetBIOS/SMB protocols, not TCP/IP. admittedly i've only dealt with them when configuring Samba to win them over win2k/XP. –  quack quixote Feb 7 '10 at 19:53
show 1 more comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.