4 ms·
You get a lot more than 2 bytes, because your NAT tables can map both sender and receiver (IP, TCP port) tuples to a connection.
by jganetsk 15y ago
You get a lot more than 2 bytes, because your NAT tables can map both sender and receiver (IP, TCP port) tuples to a connection.
- dpark 15y agoHow does that work? You add two bytes to the address and somehow that makes the address longer by more than 2 bytes?
- nknight 15y agoHis point is that full-blown NAT/PAT is really 2 + 4 + 2 = 8 bytes on top of the base IP address for your system. The tuple for a connection is: source IP = 4 bytes source port = 2 bytes dest IP = 4 bytes dest port = 2 bytes For 12 bytes, or (in theory) 96 bits of ephemeral address space.
- dpark 15y agoOkay, but I don't see how that increases the address by more than 2 bytes. Without NAT, you've got 4-byte addresses. The source/dest tuples have an 8-byte space, but each IP address is only 4 bytes. If the tuple space for NAT is 12 bytes, then each address is 6 bytes, or 2 bytes larger than without NAT. It doesn't seem very meaningful to talk about tuple space, because we don't assign a tuple to each host. If we had 2^8 addresses, we wouldn't be nearly so worried about IP address exhaustion. But we don't have 2^8 addresses. We have 2^8 tuples.
- jganetsk 15y agoYou could have multiple hosts on the internal network appear to the outside world as the same (IP, TCP Port) tuple because they are connected to external different addresses. To illustrate, let's say my network's external IP address is X. Let's choose some port number Y. A packet addressed to X:Y could be going to any one of several machines on my internal network, because the NAT uses the source (not just the destination) as part of its lookup. So X:Y does not uniquely identify a machine... it's only part of the total address.
- dpark 15y agoAh, I see what you mean now. Thank you for clarifying.