3 ms·

>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There i

>> There are limits to how many devices you can put behind a single IPv4 address. Do you mean ~65k devices behind a single public IPv4 address? [0] >> There is the case of Belgium where law enforcement asked ISPs to limit CGNAT to 16 customers per IPv4 address. Well if law enforcement in Belgium asked, of course we all need to immediately work to redesign the global IPv4 internet to comply. </sarc> [0] https://learningnetwork.cisco.com/thread/81720 https://learningnetwork.cisco.com/thread/81720

richardwhiuk 8y ago
> Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports on the NAT device. I'd imagine that most clients need at least 2^4, and possibly up to 2^8 simultaneous connections to ensure that you don't introduce problems. At the level, you have a limit of 2^8 - 2^12 clients (i.e 256 - 4096).
- buzer 8y ago
  You can actually get more than 65k connections per address depending on NAT technology. Traffic coming from 1.1.1.1:80 to 9.9.9.9:12121 can be mapped to 192.168.1.1:3333 while traffic coming from 2.2.2.2:80 to 9.9.9.9:12121 can be mapped to 192.168.1.100:9999. GCNAT devices usually support that.
- zzzcpan 8y ago
  The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies of small number of clients per IP, sometimes even rotating IPs, all to minimize effect of bans on users sharing the same IP.
  - richardwhiuk 8y ago
    It's not as unlimited as you might hope. For a typical provider, a large proportion of their traffic is going to go to a limited number of properties (e.g. facebook, google, youtube). Each of those properties is only going to return a limited number of IP addresses, and all of the traffic is going to be to a very small number of ports (i.e. 443/80). I can well believe that clients connects via a single ISP to a single remote port a large multiple of times.

richardwhiuk 8y ago

> Do you mean ~65k devices behind a single public IPv4 address? [0] That's an absolute limit of 2^16 (65k) - the practical limit is much lower. If you only allow one connection per client, then yes, you can get to 65k with TCP/UDP. If you want more than one connection per client (e.g. because the user wants to download content from Facebook while also downloading a YouTube advert), you need to allocate multiple ports on the NAT device. I'd imagine that most clients need at least 2^4, and possibly up to 2^8 simultaneous connections to ensure that you don't introduce problems. At the level, you have a limit of 2^8 - 2^12 clients (i.e 256 - 4096).

buzer 8y ago
You can actually get more than 65k connections per address depending on NAT technology. Traffic coming from 1.1.1.1:80 to 9.9.9.9:12121 can be mapped to 192.168.1.1:3333 while traffic coming from 2.2.2.2:80 to 9.9.9.9:12121 can be mapped to 192.168.1.100:9999. GCNAT devices usually support that.
zzzcpan 8y ago
The 65k limit only applies to concurrent connections to the same remote ip and port. Meaning that you can only make 65k connections from a single IP to the same port of another IP. Which is unlimited for all practical purposes. However, popular services that could potentially see a lot of connections - ban IP addresses, do rate limiting, don't allow that many connections from a single IP. This in turn drives policies of small number of clients per IP, sometimes even rotating IPs, all to minimize effect of bans on users sharing the same IP.
- richardwhiuk 8y ago
  It's not as unlimited as you might hope. For a typical provider, a large proportion of their traffic is going to go to a limited number of properties (e.g. facebook, google, youtube). Each of those properties is only going to return a limited number of IP addresses, and all of the traffic is going to be to a very small number of ports (i.e. 443/80). I can well believe that clients connects via a single ISP to a single remote port a large multiple of times.