3 ms·

> [An ISP-level] NAT router will have to handle large numbers of connections simultaneously, to the point that it will run out of port numbers. Ports numbers ar

> [An ISP-level] NAT router will have to handle large numbers of connections simultaneously, to the point that it will run out of port numbers. Ports numbers are only 16 bits, after all. That's only if you track NAT by <my_port> only; just use <my_addr>,<my_port>,<remote_host> instead (Windows tracks ports only, but everything else seems to get it right). Of course, big routers are still expensive, and the other issues are quite real.

bryanlarsen 16y ago
That works for already established connections, but how does that work for new connections from unknown remote hosts?
- bensummers 16y ago
  You create the mapping when the connection is opened. Remember you only have to deal with outgoing connections from hosts behind the NAT device.
- JoachimSchipper 16y ago
  You could imagine something uPnP-like (or maybe just uPnP - I'm not too sure about how that protocol works) to dynamically create <remote_addr> -> <my_box> mappings; otherwise, just drop the packets. (Software already works behind bad NAT routers - dealing with this particular atrocity is nothing new.)
simcop2387 16y ago
And what do you do when two people want to go to youtube at the same time? since the packets coming back could be to the same port from the same remote host you can't say which is which. You might be able to get around this by using the tcp window field but the more you have to examine the packets to do this the more expensive it becomes to route packets. And even then you aren't sure that you won't have the same things happening with the same window parameter. there's all kinds of complicated multiplexing and routing you can do but eventually it just becomes cheaper to switch to ipv6 and not have to deal with these issues at all.
- JoachimSchipper 16y ago
  It's not like a single youtube IP is going to stream data to more than 2^16 clients - the whole thing is heavily clustered and distributed, after all. Yes, this may become an issue in the future.
joeyh 16y ago
To quote the first comment from LWN: " I've seen situations where the same (src ip, src port, dest ip, dest port) are reused within 3 seconds of the FIN from the first connection coming past. A large corporation NATted behind a single IP."

bryanlarsen 16y ago

That works for already established connections, but how does that work for new connections from unknown remote hosts?

bensummers 16y ago
You create the mapping when the connection is opened. Remember you only have to deal with outgoing connections from hosts behind the NAT device.
JoachimSchipper 16y ago
You could imagine something uPnP-like (or maybe just uPnP - I'm not too sure about how that protocol works) to dynamically create <remote_addr> -> <my_box> mappings; otherwise, just drop the packets. (Software already works behind bad NAT routers - dealing with this particular atrocity is nothing new.)

simcop2387 16y ago

And what do you do when two people want to go to youtube at the same time? since the packets coming back could be to the same port from the same remote host you can't say which is which. You might be able to get around this by using the tcp window field but the more you have to examine the packets to do this the more expensive it becomes to route packets. And even then you aren't sure that you won't have the same things happening with the same window parameter. there's all kinds of complicated multiplexing and routing you can do but eventually it just becomes cheaper to switch to ipv6 and not have to deal with these issues at all.

JoachimSchipper 16y ago
It's not like a single youtube IP is going to stream data to more than 2^16 clients - the whole thing is heavily clustered and distributed, after all. Yes, this may become an issue in the future.

joeyh 16y ago

To quote the first comment from LWN: " I've seen situations where the same (src ip, src port, dest ip, dest port) are reused within 3 seconds of the FIN from the first connection coming past. A large corporation NATted behind a single IP."