I remember hearing the saying that the packets don't lie.
So let's leverage that reality and take a look at some packets
both before and after they go through a router
that's performing network address translation.
And so let's use this typology once again.
And for the internal device, let's
go ahead and use PC1 or computer one that's
at the IP address of 10.1.0.11.
Let's also imagine that there's a server here on the internet,
and its AP address on the internet is 67.83.0.2.
Oh, wait a sec.
Oh my gosh, hey.
So I just got a text that my grandson was just born.
His name is Connor.
Six pounds, 13 ounces.
All right, so.
I'll reply to that text after this Nugget is done.
So that new baby is from my son, Brody
and who more importantly from his wife, Sabrina.
So congratulations to you both.
I'll get right back with you.
So getting back to our typology with the network address
translation, and network address translation
doesn't have to be done by a router.
It could be done by a firewall or a router.
And in some environments, it's possible
that we're having network address translation or port
address translation in multiple points in the network
between the client and the server
that it's communicating with.
So for our protocol analysis, let's imagine
that this computer 10.1.0.11 is making a TCP synchronization
request over to the server and that it's using
the source port of 21,585.
So it's source IP address will be 10.1.011.
And the TCP source port will be 21,585.
Now if we're using PAT, the device
performing the network address translation with PAT
gets to choose what the new source port is going to be.
So for discussion let's imagine that the translation device
is going to use a new source port for the translation of TCP
port 40 96.
And regarding the IP address for translation,
let's use the IPv4 address of 23.1.1.1.
So before translation we have the source IP address
and source TCP port.
And after translation, we'd have the source AP address of this
and the source TCP sort of this.
And if this client is sending a packet to the destination
right here of the server, that destination
is not going to change in the packet after the translation.
The destination is still going to be 67.83.0.2.
And let's imagine that the server is
listening on TCP port 21,586.
Some custom applications is using that port.
As that packet goes out, all the NAT/PAT device
is going to be doing is swapping out the source information.
And it's going to leave the destination IP
address and the destination port intact.
It's not going to change those.
And then when the server responds back
to the IP address and port, the translation device
will then untranslate the port and the IP address
and then forward that response from the server
back to the client at the IP address
and port that that client is expecting that response
to come in on.
So here we have a capture of the original packet
somewhere on the network before it went through the translation
device.
So here we have the source IP address
of 10.1.0.11, the destination address of the server,
and then here we have the TCP source port and the TCP
destination port.
And then after translation, we can
see that the source address is now 23.1.1.1.
And the source port has also been translated
to show a source port of 4,096.
We can also see right here in the packet capture
that the destination IP address and destination
port after translation is the same
as it was before translation.
Because all we're doing on the initial packets
to go out to the servers is we're simply
translating the source IP address and source port.
And if we were to look at the translation table
on the router or firewall that's doing the translation for us,
it would reflect that same information.
So inside local, the real IP address that the PC is using
is 10.1.0.11 with a source port of 21,585.
That matches up with our protocol capture right here.
And it's also showing us that when it gets mapped,
it's going to have an outside routable address of 23.1.1.1
which maps up with that guy right there
and also a new source port of 40 96
which is reflected right here as well.
And regarding the server information, the destination
port and the destination IP address
did not get changed based on the translation we're
doing on behalf of the client who's
going out to the internet.
In this Nugget, we've used Wireshark
to take a look at the before and after picture with port address
translation.
And now my friend, it is time for me to get back to my son
and wish him congratulations on the new baby.
So thanks for joining me in this Nugget.
I hope this has been informative for you.
And I'd like to thank you for viewing.