NAT and ICMP

Engineering First Principles

This module explores the core principles of NAT and ICMP, deriving solutions from first principles and hardware constraints to build world-class, production-ready expertise.

1. NAT (Network Address Translation): The Ultimate Hack

In the early 1990s, engineers realized a catastrophic problem: the internet was running out of IP addresses. IPv4 only allows for roughly 4.3 billion unique addresses, and the explosion of personal computing meant we would exhaust them quickly.

Instead of immediately migrating the entire world to IPv6 (a logistical nightmare), they invented NAT (Network Address Translation). NAT is arguably the most successful “temporary hack” in computing history—it is the primary reason the internet still functions today.

The Problem NAT Solves

Imagine an office building with 500 employees. If every employee needed a direct outside phone line, the company would have to buy 500 expensive phone numbers. Instead, the company buys one public phone number for the reception desk. When an employee calls out, the receiver sees the reception’s number. When an external call comes in, the receptionist uses an “extension” to route the call to the correct private desk.

NAT does exactly this for IP addresses.

  • Public IP (The Receptionist): Routable on the global internet. Expensive and scarce. (e.g., 8.8.8.8)
  • Private IP (The Employee Desk): Non-routable on the internet. Free and reusable within local networks. (e.g., 192.168.1.10)

Anatomy of PAT (Port Address Translation)

The most common form of NAT used in homes and enterprise edge routers is PAT (Port Address Translation), also known as NAT Overload. PAT allows thousands of internal private IPs to share one single Public IP.

It achieves this by using TCP/UDP Source Ports as the “extensions” for the receptionist.

The Outbound Flow

  1. The Request: Your laptop (192.168.1.10) wants to view a webpage on Google (8.8.8.8 on Port 80). It randomly selects a source port, say 5001.
  2. The Interception: The request hits your home router. The router knows 192.168.1.10 cannot traverse the internet.
  3. The Translation: The router swaps out the Private Source IP for its own Public Source IP (203.0.113.5). It also generates a new, unique Source Port on its end, say 44321.
  4. The Mapping: The router records this translation in its stateful NAT Table:
    • 192.168.1.10:5001 <-> 203.0.113.5:44321 (Dest: 8.8.8.8:80)

The Inbound Flow

  1. The Reply: Google processes the request and sends the webpage back to the Source IP it saw: 203.0.113.5 on Port 44321.
  2. The Lookup: The router receives the packet. It checks its NAT Table for port 44321.
  3. The Reverse Translation: It finds the mapping, swaps the destination back to 192.168.1.10:5001, and forwards the packet to your laptop. Your laptop is completely unaware that NAT ever happened.

2. Interactive Case Study: The Stateful NAT Table

Understanding the stateful nature of the NAT table is crucial. If the router loses power and clears its NAT table, all active connections are immediately dropped because the router no longer knows how to reverse-translate inbound packets.

💻
Internal Client
IP: 192.168.1.10
Port: 5001
→
Edge Router (NAT)
Public IP: 203.0.113.5
NAT Translation Table
[Awaiting Connection]
←
☁️
External Server
IP: 8.8.8.8
Port: 80
System Idle
Edge Case: NAT Traversal

Because NAT hides internal IP addresses, external servers cannot initiate connections to internal clients (because the private IP is non-routable, and the public IP has no existing port mapping). This breaks peer-to-peer applications like VoIP, WebRTC, and multiplayer gaming. Engineers bypass this using techniques like STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT).

3. ICMP (Internet Control Message Protocol): The Diagnostic Backbone

While TCP and UDP carry user data (webpages, video streams), the network layer needs a way to communicate about itself. If a router drops a packet, how does the sender know?

Enter ICMP. It is the diagnostic nervous system of the Internet.

Crucially, ICMP has no concept of “Ports”. It operates purely at Layer 3 (Network Layer). You cannot “port forward” an ICMP packet, which is why pinging a home router often requires specific firewall exemptions rather than a NAT port rule.

Core ICMP Message Types

ICMP messages are categorized by Type and Code numbers.

| Type | Name | Purpose | | :— | :— | :— | | 0 | Echo Reply | The response sent back after a successful Ping. | | 3 | Destination Unreachable | A router drops a packet because it has no route to the destination IP. | | 8 | Echo Request | The initial packet sent when you execute the ping command. | | 11 | Time Exceeded | Sent when a packet’s TTL drops to 0. The foundation of traceroute. |

Case Study: How traceroute Actually Works

The traceroute command doesn’t use a magical “trace” protocol. It cleverly exploits the IPv4 TTL (Time to Live) field and ICMP Type 11 (Time Exceeded) messages to map the internet.

The TTL is a counter on every IP packet. Every time a router processes the packet, it decrements the TTL by 1. If the TTL hits 0, the router discards the packet (to prevent infinite routing loops) and sends an ICMP Time Exceeded message back to the sender.

The PEDALS Breakdown: Traceroute

  • P (Process): Map every intermediate router (hop) between our client and google.com.
  • E (Estimate): Maximum of 30 hops (the default max TTL limit).
  • D (Data): ICMP Packets or UDP datagrams with artificially modified TTL fields.
  • A (Architecture/Algorithm):
    1. The client sends a packet to google.com with TTL = 1.
    2. The first router (Hop 1) receives it, decrements TTL to 0, drops it, and replies with ICMP Time Exceeded. The client records the IP of Hop 1.
    3. The client sends a new packet with TTL = 2.
    4. Hop 1 decrements it to 1 and passes it along. The second router (Hop 2) decrements it to 0, drops it, and replies with ICMP Time Exceeded. The client records Hop 2.
    5. This repeats (TTL=3, TTL=4…) until the packet reaches the actual destination, which replies with a success message (ICMP Echo Reply or TCP RST).
  • L (Localized Details): Firewalls often block incoming ICMP Type 11 messages. This results in the infamous * * * output you see in terminal traceroutes, indicating a “silent” router hop.
  • S (Scale): Traceroute is lightweight but slow if done sequentially. Modern implementations send multiple probes concurrently to map paths faster.