Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just been thinking about what the maximum number of client connections would be out of my home LAN to a single server on the internet. My home router is also NAT'ing the connections to convert my LAN IP address to my public IP address.

Let's say the maximum number of client connections from a single machine in my network is 65535 where I've used all the available ports for client connections. My router would have a table like so for client A, router B and server C.

For convenience I'm assuming the router will use the same port sequencing as the client but this obviously won't happen in reality.

                    |       Home        |     Server (C)    |
                    |      Router (B)   |                   |
                    |-------------------|-------------------|
Client A:Port 1     |  A:1       C:80   |  B:1       C:80   |
Client A:Port 2     |  A:2       C:80   |  B:2       C:80   |
.
.
.
Client A:Port 65534 |  A:65534   C:80   |  B:65534   C:80   |
Client A:Port 65535 |  A:65535   C:80   |  B:65535   C:80   |
                    |---------------------------------------|
  • All the available ports on client A are now in use

If a second client (X) tries to connect to server C (or any other server), then Router B has no more ports available on the outgoing IP address (assuming it has just one of these).

Will this connection fail? How will this manifest itself on the client(s)? Is this a very unlikely scenario or is is something you may encounter under slightly different conditions in the real world? For example, if I had 10,000 clients using this router I'd imagine it would be much easier to cause port exhaustion on a router. How do you handle this and avoid it in the real world?

share|improve this question
add comment

3 Answers

The router (unless it is additionally a firewall or a NAT gateway) can handle arbitrarily many connections - because it does not handle the connections at all, it merely routes and can do so on a packet by packet base.

But if you are really talking about NAT, which establishes a new connection from the router to the destination host, the situation changes. If destination ip and destination port and source ip are the same, the connections can indeed only be distinguished by the source port (sequence numbers play a role only within the connection). So, yes, in this case only a total of 65536 concurrent connections to the same destination (ip+port) is even theoretically possible. Real-life limits may of course be lower (e.g. so many connections to the same destination may be blocked much earlier as they look like an attack).

EDIT: Following symbean's comment, technically the resource limit may rather be at the remote hosts end. Also note that this applies only to the case of many connections to the same destination port on the same destination address. Note that a connection is represented by a socket, which consists of atuple (source ip, source port, destination ip, destinatiopn port), hence no restrictions apply if the other client tries a different destination host or port (or even if A tries a differerent destination ip or port).

share|improve this answer
    
NAT doesn't have to establish a new connection (in fact it rarely does - more commonly it just readdreses the packets). Also, the OP seems to be talking specifically about masquerading - there are other varieties of NAT. There is no resource limit in terms of number of connections for a stateless firewall. –  symcbean May 21 '13 at 10:23
    
@symcbean Even if the router should do stateless masquerading - from the point of view of the destination host, it looks like all connections come from the router ip hence the connections (or more precisely sockets) from the same ip to the same ip and port can differ only in their source ports, hence even if the router has no problems masquerading and routing the additional packets, the destination host will only accept up to 65536 such conncetions. Without looking it up, I'm not 100% sure if a SYN received on a CONNECTed socket is simply discarded or even triggers a RST. –  Hagen von Eitzen May 21 '13 at 11:23
    
"stateless masquerading" is surely an oxymoron? When you say a SYN received on a CONNECTed I presume you refer to to the initialization of a new TCP connection - however this should never occur - the issue is whether the internet facing IP address has free port numbers to map a new, internally originated packet to. –  symcbean May 21 '13 at 12:42
add comment

You seem to be talking about masquerading NAT.

Yes, this kind of exhaustion can and does occur in the real world. But it's very unlikely with a 'home' network (try monitoring the number of active connecions on your machine to work out how many active machines you'd need to use up all the available ports).

The solution (used by many large providers and IPv6 PoPs) is to use more than one 'external' address.

IIRF, rfc 3022 (which defines NAT) doesn't specify what happens in the exhaustion scenario - but you might want to read it carefully.

share|improve this answer
add comment

I think you're going to run into limits on the CPU being able to forward that many packets well before you run out of available ports. Most SOHO routers have fairly limited capabilities, larger routers tend to drop older connections, though it is probably a configurable behavior.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.