There's still an upper limit of 64K listening ports at the top level of NAT for both TCP and UDP. The UDP side is probably worse. A shortage of UDP ports woul

There's still an upper limit of 64K listening ports at the top level of NAT for both TCP and UDP. The UDP side is probably worse. A shortage of UDP ports would pin down DNS servers to a single IP:port and make spoofing responses easier. You'd also need a DNS cache at each level of NAT to avoid burning through top-level UDP ports for DNS. That would mean that any successful DNS poisoning would hang around until the bad responses get flushed out of the resolvers. (If you're very lucky and the TTL is followed correctly, that would be after the top-level TTL expires.)