Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If two hosts X and Y are connected to the Internet with NAT. Both NATs are of cone-restricted type.

Now assume there's a server Z which stores all translated public addresses of X and Y. Both X and Y can get each other's translated public IP address from Z.

Now X wants to talk to Y, but X can't send a message to Y using Y's public IP because Y's NAT is cone-restricted.

But if both X and Y send a message to each other simultaneously, then their message can reach X and Y.

Can anyone tell me why this happens??

share|improve this question
Is this question relevant to any real-world scenario or are we posting exam questions? – August Mar 28 '13 at 18:58
up vote 0 down vote accepted

It happens because cone restricted NAT allows replies only when the traffic originates from the internal address. The requirement is that the internal address sends the original SYN, then the state will be stored in the NAT tables for a certain period of time, during which the external client (in this case behind another cone restricted NAT) can reply to them by sending packets to the mapped port/address. Since they are both performing this action, both will have the window of connectivity opened.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.