1

The highest TCP port number is 65535. If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is possible for the router to run out of ports? What is going to happen when the router runs out of ports?

1
  • When a connection is closed, the ephemeral port is released for reuse. If your question is "Can I have more than 65,535 connections open simultaneously?", the answer is NO.
    – waltinator
    Commented Apr 19, 2022 at 22:26

4 Answers 4

4

If a router doing NAT uses an ephemeral port for each connection made to the internet on behalf of the hosts on the internal network, does this mean that it is possible for the router to run out of ports?

Theoretically, but unlikely.

NAT (usually) works on a mapping of the tuple { source IP, destination IP, source port, destination port }. For your router, one of the IP addresses is itself and the other three components of the tuple are typically going to vary per connection. Let's assume we're applying NAT to an outgoing packet (rather than its reply). The source IP, destination IP, and destination port will be known and fixed. The source port can vary. That gives you approximately 65000 concurrent connections to the same service on the same host. Typically you'll be accessing multiple servers on multiple services, so the numbers shoot way up very quickly indeed.

You are far more likely to run out of space in the connections state table, which can probably handle only a few hundred concurrent connections. Even if it can handle a few thousand concurrent connections it's still far fewer than the numbers we've just considered.

Once you run out of space, what happens next is implementation dependent. The router software might refuse to allow additional connections, or it might kick out the one least recently used. Regardless, it might or might not return error information for the corresponding connection attempt.

There's a good article on CloudFlare that describes a little about the Linux implementation of connection tracking.

2

Yes, it is possible for a NAT router to run out of ports.

What happens at that point is decided by the specific NAT router implementation, but generally I would expect that a common strategy might be throwing out the least recently used active connection (i.e. the connection that has been idling without traffic the longest time) and reusing its port.

However, the relevant RFCs say that a TCP connection is identified by the combination of 4 identifiers:

  • source IP address
  • destination IP address
  • source port
  • destination port

A difference in just one of these is (and must be) enough to differentiate between two connections.

While a host typically uses one port for every outgoing connection (as a source port), a NAT router can reuse port numbers as long as all the other three identifiers are not the same.

So, a NAT router with an external IP address of N.N.N.N could map one outgoing connection as N.N.N.N:60000 -> 1.2.3.4:80 and another simultaneous connection as N.N.N.N:60000 -> 4.5.6.7:80 just fine, as the different destination IP address will be enough to identify the packets as belonging to two separate connections.

As a result, running out of port numbers is fairly unlikely to happen in practice if the NAT implementation is properly designed to handle large numbers of connections.

1

Yes, in the same way your computer can run out of ports if it opens too many network connections.

The difference is that the NAT router does not have a good way of reporting the error back, so it will probably just silently discard the packets for the new connection.

1
  • It might send back an ICMP packet of some description though I've never seen it happen to know what behaviour to expect. Commented Apr 19, 2022 at 15:32
0

Yes, the router can (theoretically) run out of ports.

I have no idea if the standard(s) say what the router should do in that situation. But as most (TCP) connections are relatively short-lived, I guess a reasonable first step would be to hold the packet and try again in a (very) short while. If ports don't become available I see two options:

  1. Silently drop the packet - with the result that the connection isn't established, but the client has to deal with it without knowing what is wrong or where the problem occured.
  2. Return an error packet - same result, but at least the client has an idea where the prblem occured.

I said "theoretically", because in the real world NAT is typically only used in situations where you have more than enough (IP's+)ports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .