2

I think I'm correct in saying that:

  1. OSes generally use the IANA ephemeral port range of 49152 to 65535.
  2. Apps generate a random ephemeral port to establish a connection from the client to the server.
  3. NAT translates IP addresses, usually private-public.

So, how do ephemeral ports work with NAT?

As far as my understanding goes (I'm sure that I'm missing something), shouldn't there be a possibility (higher on larger networks) that ephemeral ports could conflict in the network or on the server if, for example, two or more clients happen to generate and use the same random ephemeral port to connect via NAT?

4

There is no conflict because connected socket is defined by the following four values:

  1. Source IP
  2. Destination IP
  3. Source port
  4. Destination port

Two different clients means there is at least one different value which is the source IP even when accessing the same server/service.

To relate this with NAT, the router/gateway will create a new mapping for each new connection. This mapping is saved to be able to return further responses to user and to use it while the connection is valid. This is called connection tracking in terms of Linux netfilter.

  • But if, for example, a public IP address is 100.100.100.100, the private subnet is 192.168.0.0/24, and 192.168.0.50 and 192.168.0.51 generate and use 50000 to connect to 216.58.204.35:443 then won't 216.58.204.35 send traffic destined to 100.100.100.100:50000 twice for each session? – mythofechelon Feb 20 '17 at 14:39
  • The server 216.58.204.35 will not see two requests from same port 50,000. This is simply because the NAT router will change the port to something else like 50,001 for 192.168.0.50 and 50,002 for 192.168.0.51. The port will be changed back before returning response to client. – Khaled Feb 20 '17 at 14:43
  • Ah, I see. That must have been what I was missing. Thanks, Khaled! – mythofechelon Feb 20 '17 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.