Good points, and there's a sibling comment which notes some of this as well. One thing to note is that your ISP is absolutely going to be logging every flow, w

Good points, and there's a sibling comment which notes some of this as well. One thing to note is that your ISP is absolutely going to be logging every flow, with (at the very least) the following details: SRCIP, SRCPORT, TRANSLATED SRCIP, TRANSLATED SRCPORT, DSTIP, DSTPORT As to how the translations are occurring, I've never actually managed a CGN platform myself, but based on my knowledge of other hardware, I suspect you're closer to the reality than I was, and it's likely that a SRCIP always results in the same TRANSLATED SRCIP, as that can then be installed in hardware trivially and no longer needs to traverse the punt/cpu path to lookup what the translation needs to be. That does leave the system open to abuse though, depending on how quickly entries age out, as a single customer could easily open up 65k sockets in a very short span of time, effectively DoS'ing any other customers who are using the same TRANSLATED SRCIP if there are no free TRANSLATED SRCPORTs left that their translation can bind to. Then again, the risk of this could be perceived to be low, with a AUP that can handle this if it turns out to be a social rather than technical problem, so it could still be happening in the wild anyway. This remains a good reminder for me to avoid speculating about topics I haven't thought too deeply about!