2

When will the router remove an entry from its NAT (net address translation) table?

Most routers used in our homes maintain a NAT table to translate the public IP and port to the private ones. This is an excellent mechanism to protect our local networks and remedy the shortage of public IPv4 addresses. However, the total public-side ports the NAT can use to map is a limited resource which is only up to 65536 (the number of 16bits integers). So, I guess the router must maintain its NAT table and recycle the finished mapping at some time.

BUT, how could the router identifies a finished connection and remove it safely?

1 Answer 1

1

BUT, how could the router identifies a finished connection and remove it safely?

For TCP/SCTP, it reacts to the usual "connection close" messages (FIN or RST) that TCP endpoints send to each other. (And there is usually also an idle timeout, e.g. idle connections will be forgotten after 7 days even if a close message wasn't seen.)

For UDP/ICMP/etc., it has a simple idle timeout (but much shorter one) – often streams are forgotten as soon as 5 minutes after they become idle. The router doesn't actually know whether the stream is already over, it just assumes that it is.

(UDP-based protocols such as VPN services usually have an option to send periodic "keep-alive" packets specifically to prevent the stream from being forgotten by intermediate NATs and firewalls.)

Note also that every protocol has an independent port namespace. That is, TCP ports 1-65535 are completely independent from UDP ports 1-65535 or SCTP ports 1-65535. Some protocols such as GRE and ESP do not have ports at all (and are therefore incompatible with '1:many' NATs).

However, the total public-side ports the NAT can use to map is a limited resource which is only up to 65536 (the number of 16bits integers).

Technically, the same local port number can be reused so long as the whole (localIP, remoteIP, localport, remoteport) combination remains different. So it's not required to be 65535 local ports total – it can actually be 65535 local ports for every different remoteIP:remotePort.

But only some NAT gateways actually reuse ports in this way – and from what I know, it makes NAT traversal / hole punching much more difficult, and makes protocols like STUN nearly useless.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .