I have three computers connected to a router at home. I am sure my router has only one address. When the packet arrives from computer 1, the source IP is translated to the router IP address.

Let's say both computers 1 and 2 access the same destination, this time the entry in the NAT will have the same destination address. So, how is the packet forwarded here?

When the packet arrives from destination, how are the packages distinguished between computer 1 and 2? I have a Belkin router, is it generating many source addresses. For example, dynamic NAT, each source IP is converted into a different IP address? How does it generate a pool of addresses.


The router does not only translate the source address, it also translates the source port. When two machines on the network make similar requests, for example visiting superuser.com at, the router translates the source ports to be unique. When the replies arrive, the router can distinguish both based on their destination ports and consults the connection table to see which one is to be forwarded to which machine. In the example of two people browsing on Super User, the connection table may look something like this:

root@FAKEROUTER:~# grep /proc/net/ip_conntrack
tcp      6 3597 ESTABLISHED src= dst= sport=50000 dport=80 packets=8 bytes=1637 \ 
    src= dst= sport=80 dport=50000 packets=14 bytes=14747 [ASSURED] mark=20 secmark=0 use=1
tcp      6 3598 ESTABLISHED src= dst= sport=50000 dport=80 packets=8 bytes=1637 \
    src= dst= sport=80 dport=50001 packets=14 bytes=14747 [ASSURED] mark=20 secmark=0 use=1
  • Is this screen shot from a router? How can I telnet on to the router to run such commands? – dexterous Feb 13 '14 at 9:36
  • @SHREYASJOSHI: It is very straightforward. You start a telnet client and connect to the router, but I do not believe yours supports this feature. The manual makes no mention of telnet or SSH. You can of course try nonetheless. If it doesn't work, you would have to install different firmware. – Marcks Thomas Feb 13 '14 at 11:38
  • No, I couldn't telnet on to it. Looks like, I need to look for a different firmware. I don't know whether belkin can help me on it or not. – dexterous Feb 13 '14 at 15:34

Home routers do NAPT, Network Address and Port Translation. This means the source port is also modified, not just the source address. Usually, each connection is given a unique external port number, which is how the router recognizes the connection. It also implies that you can only have 65535 simultaneous connections no matter how many devices are behind the router.

  • Ok, so Src IP is same at home router i.e. the IP of router. However, the port number will be different for different computers. Am I correct on it? – dexterous Feb 12 '14 at 16:55
  • Yes, each connection has a different port number. The port is not directly attributed to the computer but to the connection which is linked to the computer. Once that connection is over another computer opening a new connection may theoretically get that port number. – user2313067 Feb 12 '14 at 16:59
  • while sending the packet, where this external port number be encapsulated in the packet. I am sure this cannot change the TCP port number as you mentioned it is external. Now, where this external port number be encapsulated, so that on return it can identify it back. – dexterous Feb 12 '14 at 17:03
  • By external I meant facing the exterior of the home network. It does change the TCP (or UDP) port number. – user2313067 Feb 12 '14 at 17:05
  • Just a NAT is used where in the networking? Is it used by ISP? But, why ISP would require it? – dexterous Feb 12 '14 at 17:13

Not the answer you're looking for? Browse other questions tagged or ask your own question.