GSEC · Question #368
Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?
The correct answer is C. The client-side source ports are different. NAT uses the combination of source IP address and source port to uniquely track each connection, so two clients behind the same public IP can connect simultaneously to the same server only if their source ports differ.
Question
Two clients connecting from the same public IP address (for example - behind the same NAT firewall) can connect simultaneously to the same web server on the Internet, provided what condition is TRUE?
Options
- AThe server is not using a well-known port.
- BThe server is on a different network.
- CThe client-side source ports are different.
- DThe clients are on different subnets.
How the community answered
(58 responses)- A12% (7)
- B9% (5)
- C74% (43)
- D5% (3)
Why each option
NAT uses the combination of source IP address and source port to uniquely track each connection, so two clients behind the same public IP can connect simultaneously to the same server only if their source ports differ.
The destination server port, whether well-known or not, is on the server side of the connection and has no effect on NAT's ability to differentiate multiple clients sharing the same public IP address.
Whether the server resides on a different network is unrelated to NAT port address translation and does not affect the multiplexing of simultaneous connections from behind a NAT device.
A NAT device maintains a translation table keyed on the 5-tuple (protocol, source IP, source port, destination IP, destination port); when two internal clients have different source ports, the NAT can create two distinct table entries under the same public IP, correctly mapping return traffic to each client independently and enabling simultaneous sessions.
The private-side subnet assignment of the clients is irrelevant once NAT translates their addresses; only the source port seen at the public interface determines whether NAT can distinguish the sessions.
Concept tested: NAT port address translation for simultaneous client connections
Source: https://www.rfc-editor.org/rfc/rfc3022
Topics
Community Discussion
No community discussion yet for this question.