Network Address Translation (NAT): private ranges, NAPT & trade-offs

1. Why must a router recompute the IPv4 header checksum whenever it modifies a header field?
   Stuck? Peek at 3.2.2 IPv4 fragmentation, offsets, MF bit & multi-hop re-fragmentation

   • Max data per fragment: d_max = ⌊(MTU − H)/8⌋ × 8 (must be a multiple of 8 B).
   • Offset = start_byte / 8 (relative to original datagram); MF = 1 on all fragments except the very last of the original datagram (MF = 0).
   • Original payload from last fragment (MF=0): 8 × Offset + (TotalLength − 4×HLEN).
   • Reassembly: ONLY at final destination host.

   Read lesson 3.2.2

2. Approximately how many total addresses exist in the 32-bit IPv4 space?
   Stuck? Peek at 3.1.2 Classful addressing (A–E) and special IPv4 addresses

   • Classes by 1st octet: A = 0–127 (0, 8 net bits), B = 128–191 (10, 16 net bits), C = 192–223 (110, 24 net bits), D = 224–239 (1110, multicast), E = 240–255 (1111, reserved).
   • Usable hosts = 2ʰ − 2 (exclude host all-0s = network address, host all-1s = directed broadcast).
   • Specials: 0.0.0.0 = this host (src only); 255.255.255.255 = limited broadcast (local LAN only); 127.x.y.z = loopback.

   Read lesson 3.1.2

3. What is the generic name from Phase 1 for the identifier that tells a host which running program (process) a message is for?
   Stuck? Peek at 1.1.3 Encapsulation, headers, PDU names, addresses and devices per layer

   • Encapsulation: payload + header (+ trailer at data link); decapsulation in reverse.
   • PDUs: message (app) → segment (transport) → packet/datagram (network) → frame (data link) → bits.
   • Addresses: link (per hop, changes) · network (end to end, fixed) · which-program id · names.
   • Devices: hub/repeater 1 · bridge/switch 2 · router 3 · gateway/host up to 7.
   • Efficiency = data / (data + all headers + trailer).

   Read lesson 1.1.3

Your home Wi-Fi router has a phone, two laptops, a tablet, and a smart TV connected — 5 devices, each needing an IPv4 address. Multiply that by a billion homes and offices, and 4.3 billion IPv4 addresses would have run out decades ago!

The clever workaround that kept IPv4 alive is private addressing + Network Address Translation (NAT): millions of homes reuse the exact same private IP addresses inside their LANs, and the home router translates all of them into a single public IPv4 address whenever packets go out to the Internet!

Two laptops inside your house (192.168.1.10 and 192.168.1.20) both send requests to the same external server 93.184.216.34 through your home router, which replaces both source IPs with its single public IP 203.0.113.5. When the server replies to 203.0.113.5, how on earth does your router know whether the reply is for Laptop 1 or Laptop 2?

By also translating and recording a 16-bit port number! The router maps Laptop 1 to public port 5001 and Laptop 2 to public port 5002 in its NAT translation table. When the server replies to 203.0.113.5:5001, the router looks up 5001 and forwards the packet to 192.168.1.10!

RFC 1918 Private IPv4 Address Ranges

Three blocks of IPv4 addresses are reserved as private addresses: they are free for anyone to use inside a LAN, and Internet backbone routers NEVER route packets carrying a private source or destination IP.

Port-Based NAT (NAPT) & the Translation Table

In Network Address and Port Translation (NAPT), a NAT router with one public IP 203.0.113.5 maintains a NAT translation table mapping (Private IP, Private Port) ↔ (Public IP, Assigned NAT Port):

What NAT Modifies & Architectural Trade-offs

When a packet passes through a NAPT router, what header fields must be rewritten?

• Outgoing (LAN → WAN): Rewrites Source IP, Source Port, IPv4 Header Checksum (plus TTL decrement), AND the Transport-layer Checksum (which covers IP addresses and port numbers).
• Incoming (WAN → LAN): Rewrites Destination IP, Destination Port, and both checksums.
• The Inbound Problem: An outside host cannot initiate a connection to a private host unless the NAT table already has an entry (created by an outgoing packet or manual port forwarding).

Putting it together

• Private IPv4 ranges (10/8, 172.16/12, 192.168/16) can be reused inside any LAN but are never routed on the public Internet.
• NAPT lets an entire private LAN share one public IPv4 address by multiplexing connections using 16-bit port numbers in a NAT translation table.
• Outgoing packets have their Source IP:Port rewritten; incoming replies have their Destination IP:Port rewritten.

• 172.32.x.y is NOT private! The Class B private block is 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), not all of 172.x.y.z.
• NAT is NOT a pure Layer-3 device: Because NAPT reads and rewrites 16-bit port numbers (and transport checksums), it crosses the boundary between Layer 3 (Network) and Layer 4 (Transport).

10/8, 172.16/12 (16 to 31), 192.168/16 — Outgoing rewrites SOURCE; Incoming rewrites DESTINATION!

We now know how IPv4 datagrams are addressed, subnetted, fragmented, and translated at network edges. After the Chapter 3.3 Lock-in, Chapter 3.4 answers the biggest question of the Network Layer: how do routers automatically discover the shortest path across the Internet?

1. MCQ

   Which of the following IPv4 addresses is a PUBLIC (globally routable) IPv4 address?

   1. 10.255.255.1
   2. 172.30.10.5
   3. 172.32.10.5
   4. 192.168.0.254
2. NAT

   How many Class B (/16) networks are combined to form the RFC 1918 private block 172.16.0.0/12?

   Write your answer before opening the key.

3. MCQ

   When an outgoing packet from a private LAN host passes through a NAPT router toward an external server, which addresses/ports in the packet does the NAPT router rewrite?

   1. Destination IP and Destination Port
   2. Source IP and Source Port
   3. Source IP and Destination IP
   4. Only the Source MAC address
4. MSQ

   Which of the following are valid technical criticisms or limitations of NAPT?

   1. It violates strict layering because a network-layer router modifies transport-layer port numbers.
   2. External hosts cannot initiate connections to internal private hosts without pre-configured port forwarding.
   3. It requires recomputing the IPv4 header checksum on every translated packet.
   4. It increases the number of public IPv4 addresses required by a home network.

• Private IPv4 ranges: 10.0.0.0/8, 172.16.0.0/12 (172.16..31.x.y), 192.168.0.0/16.
• NAPT table: maps (Private IP, Private Port) ↔ (Public IP, NAT Port).
• Rewrites: Outgoing → Source IP + Source Port; Incoming → Destination IP + Destination Port (+ checksums).

• private address ranges (10/8, 172.16/12, 192.168/16)
• NAT (Network Address Translation)
• NAT translation table
• port number (16-bit Foundation preview)
• NAPT (port-based NAT)
• NAT pros and cons

1. List the three RFC 1918 private IPv4 address blocks in CIDR notation.
   Reveal answer

   10.0.0.0/8, 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), and 192.168.0.0/16.
2. What does a NAPT router rewrite on an OUTGOING packet vs an INCOMING reply?
   Reveal answer

   Outgoing: Source IP and Source Port. Incoming: Destination IP and Destination Port (plus checksums in both directions).
3. How does NAPT allow two internal hosts using the same source port to talk to the same server simultaneously?
   Reveal answer

   By assigning two different external port numbers on the router’s public IP in the NAT translation table.

• 172.16.0.0/12 boundary check: /12 means the first 4 bits of the 2nd octet are fixed to 0001₂ (16), and the last 4 bits vary 0000₂..1111₂ (+0..+15) → 172.16.x.y through 172.31.x.y. — never falling for the 172.32.x.y or 172.15.x.y GATE trap.
• Outgoing vs Incoming rewrite symmetry: Outgoing changes Source (IP + Port); Incoming changes Destination (IP + Port). — tracing NAT packet headers quickly.