nerdexam
GIAC

GSEC · Question #368

Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?

The correct answer is C. The client-side source ports are different. NAT uses the combination of source IP address and source port to uniquely track each connection, so two clients behind the same public IP can connect simultaneously to the same server only if their source ports differ.

Networking and Core Concepts

Question

Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?

Options

  • AThe server is not using a well-known port.
  • BThe server is on a different network.
  • CThe client-side source ports are different.
  • DThe clients are on different subnets.

How the community answered

(58 responses)
  • A
    12% (7)
  • B
    9% (5)
  • C
    74% (43)
  • D
    5% (3)

Why each option

NAT uses the combination of source IP address and source port to uniquely track each connection, so two clients behind the same public IP can connect simultaneously to the same server only if their source ports differ.

AThe server is not using a well-known port.

The destination server port, whether well-known or not, is on the server side of the connection and has no effect on NAT's ability to differentiate multiple clients sharing the same public IP address.

BThe server is on a different network.

Whether the server resides on a different network is unrelated to NAT port address translation and does not affect the multiplexing of simultaneous connections from behind a NAT device.

CThe client-side source ports are different.Correct

A NAT device maintains a translation table keyed on the 5-tuple (protocol, source IP, source port, destination IP, destination port); when two internal clients have different source ports, the NAT can create two distinct table entries under the same public IP, correctly mapping return traffic to each client independently and enabling simultaneous sessions.

DThe clients are on different subnets.

The private-side subnet assignment of the clients is irrelevant once NAT translates their addresses; only the source port seen at the public interface determines whether NAT can distinguish the sessions.

Concept tested: NAT port address translation for simultaneous client connections

Source: https://www.rfc-editor.org/rfc/rfc3022

Topics

#NAT#source ports#TCP connections#port addressing

Community Discussion

No community discussion yet for this question.

Full GSEC Practice