CAP7001 · Unit 4: Network layer
Network address translation
10 practice questions · in the ETE syllabus
Key points
- NAT rewrites private addresses to public ones to save IPv4 space
- Static NAT is one-to-one, dynamic NAT uses a pool
- PAT also rewrites ports so one public IP serves many hosts
- The translation table matches replies to inside hosts
- Unsolicited inbound packets are dropped unless a static mapping exists
Network address translation (NAT) lets hosts with private addresses reach the Internet by having a router rewrite their packets with a public address. It slows the exhaustion of the IPv4 address space.
Three forms are common:
- Static NAT: a permanent one-to-one mapping between a private and a public address, used for servers that outsiders must reach.
- Dynamic NAT: private hosts borrow public addresses from a pool and release them later.
- PAT (NAT overload): many hosts share a single public address, and the router also rewrites the source port so each flow has a unique address and port pair.
The router keeps a translation table. For example, 192.168.1.10:5000 may map to 203.0.113.5:61000. A reply arriving for 203.0.113.5:61000 is matched in the table, rewritten back to 192.168.1.10:5000 and forwarded inside. Because the address changes, the IP header checksum and the TCP or UDP checksum are recomputed.
An inbound packet with no table entry is dropped, since the router cannot tell which host it is for. Reaching an inside server needs a static mapping or port forwarding.
Exam trap: only PAT uses port numbers to share one address. Static versus dynamic is about permanent versus pool-based mapping, not about ports.
Try two questions
A NAT router with public address 203.0.113.5 translates the inside flow 192.168.1.10:5000 to 203.0.113.5:61000 and sends it to the server 198.51.100.9:80. What are the source and destination of the server's reply as it reaches the router?
- 198.51.100.9:80 to 192.168.1.10:5000
- 198.51.100.9:80 to 203.0.113.5:61000
- 203.0.113.5:61000 to 198.51.100.9:80
- 192.168.1.10:5000 to 198.51.100.9:80
Show the answer
B. The server only knows the public address and translated port, so the reply targets 203.0.113.5:61000, and only then does the router restore 192.168.1.10:5000.
Why not A: That is the reply after the router has already translated it back to the inside host.
Why not C: That is the outgoing packet with source and destination swapped wrongly.
Why not D: That is the original packet before translation.
Two inside hosts, 10.0.0.2 and 10.0.0.3, both send from source port 4000 to the same outside server. How does a PAT router keep their replies apart?
- It refuses the second flow until the first one closes
- It maps each flow to a different translated source port in its table
- It reads the MAC address inside each reply to pick the host
- It relies on the server to add the private address to each reply
Show the answer
B. The table entries 10.0.0.2:4000 and 10.0.0.3:4000 get different public ports, such as 61001 and 61002.
Why not A: PAT is designed to carry many flows at once.
Why not C: Replies carry the router's MAC address, not the inside host's.
Why not D: The server has no knowledge of the private addresses.