Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: I have a very simple server program written in PHP. It's mostly working, but only as long as there is not more than one client per site.


  1. How does a NAT Router (typical SOHO router) know which internal client to send returning traffic?
  2. What methods might I use to differentiate between multiple clients behind NAT routers?
share|improve this question
ephemeral ports and routing/firewall tables. Though not always using ephemeral ports, your simple web browsing example typically does. While other traffic might use assigned source ports at times. – TheCleaner Jan 27 '14 at 20:00
up vote 2 down vote accepted

NAT routers would rewrite the source orig-ip:orig-port tuple of outbound UDP packets to nat-ip:nat-port and maintain a relations table between orig-ip:orig-port and nat-ip:nat-port so UDP answer packets arriving with nat-ip:nat-port as the destination could be mapped back to the orig-ip:orig-port destination. For details on how a NAT implementation might handle things, take a look at how connection tracking is implemented in Linux.

If your implementation does not allow for a changing client port number, it simply would not be guaranteed to work behind NAT routers. It might be working for one client as many implementations would try use the same source port number as the original packet's, if available, so so nat-port would be equal to orig-port for the first client's connection. But as this port becomes unavailable, subsequent attempts would inevitably lead to a condition where nat-port is different from orig-port.

So the basic "key" you would need to differentiate betwen different clients would be the client's source UDP port. Your server chat application needs to generate UDP packets going to the same destination port it received a client packet initiating the chat connection from - creating pretty much the same situation you have with established TCP sessions.

share|improve this answer
Thanks. That is actually how I was hoping for it too work... what happens if you you have a network with hundreds of computers that might not have that many ports... err... not that its likely but... I'm just curious sir.... – user1833028 Mar 7 '13 at 4:29
@user1833028 if the NAT gateway depletes the ports available for NAT, NAT can't be performed any more. But note that this is not going to happen except in rather limited circumstances (in the real world it is likely to happen if a large amount of users is running P2P software like BitTorrent) or with bad NAT implementations. Also, this is easily worked around by providing additional IP addresses for the translation to the NAT gateway. – the-wabbit Mar 8 '13 at 22:23

The router for the 192.168.1.x network assigns each outbound connection a unique source port on the Internet side. When the router gets a reply, it looks up the port the packet was sent to in its NAT table and that tells it what IP and port to put as the destination on the LAN side.

When a packet is sent from the LAN side to the Internet side, the router checks its NAT table. If there's no entry corresponding to that local source IP address, local source port, remote IP address and remote port, one is created. A new destination port address is assigned. The packet is sent to the Internet with the source IP rewritten to the router's Internet IP and the source port rewritten to the assigned source port.

When a packet is received on the Internet side, the router checks the destination port in its NAT table. If there's no entry corresponding to that remote IP and destination port, the packet is dropped (unless something else the router is doing wants it). If it is, the destination IP address is changed to the correct local IP address, the destination port is changed to the original local source port, and the packet is sent to the LAN.

The "unique ID" you speak of is the combination of the remote IP address the local machine wants to communicate with and the local source port chosen by the router.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.