Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I have understood correctly, a device performing NAT cannot do more than :

Total number of mappings = (Number of out-going Internet IP addresses) x (Number of Ports)

Is this correct..?

share|improve this question
up vote 3 down vote accepted

That is correct, in theory, be be aware of a few complications:

  • Most NAT solutions (assuming you are talking about SNAT/masquerading) will only use one address per interface, so "number of outgoing IP addresses" will be limited to 1 in most cases.
  • It won't be using the full range of 65,536 possible ports either.
  • Some mappings will be longer lived than you'd expect, especially if a stream experiences unreliable network legs.
  • You are limited by the size of the mapping table. While a software NAT solution might be able to use as much RAM as it wants to store this table hardware devices might have a limited table size (perhaps as little as 2^10 entries for cheap consumer targeted devices), and of course a software solution with access to Gbytes of RAM may still limit the number of active mappings considerably for performance reasons.
share|improve this answer
Thanks @DavidSpillett. But I didn't get how a software NAT solution is limited by space available in the RAM for storing the NAT table and not by the usable number of ports on the device performing NAT..? – Kent Pawar May 9 '13 at 14:43
If software NAT has a limit it is most likely due to the CPU time required to manage a large structure that sees many changes in short spaces of time, rather than being due to memory space limits. – David Spillett May 9 '13 at 16:37
Okay.. But even if ample CPU/RAM were provided, would a software NAT be able to create more than 65K+ IP:Port mappings..? – Kent Pawar May 10 '13 at 11:16
It depends - in theory yes but you'd need to consult the documentation for the software solution you are using. I suspect most will be limited to a range of a few 000 ports (or a couple of 0,000) on the default address of the outgoing interface. There will be some bright enough to use multiple addresses assigned to the outgoing interface to multiply up the number of ports available to use (and so number of active mapped connections) - I would assume any implementation (software or hardware) referred to as "carrier grade" is capable doing that. – David Spillett May 10 '13 at 16:13
Thanks David, that clears it up.. :) – Kent Pawar May 10 '13 at 17:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .