4.6 Network Address Translation (NAT) & IPv6 Header Architecture

Back to Computer Networks Notes

📚Module 04: Network Layer: IPv4/IPv6 Addressing & SubnettingTopic 4.6⏱️17 min read

🎯High-Yield For:Semester Exams (All Universities) • Placement Technical Rounds • Engineering Foundations

💡 Core Intuition: The Corporate PBX Switchboard & The Infinite Solar Postal System

🍳 The Everyday Analogy: The Office Extension System vs A Universe of Direct Phone Numbers

Imagine working in a 5,000-person corporate skyscraper in downtown Manhattan:

• The PBX Phone Extension (The NAT / PAT Model):

  • The telephone company assigns the corporation only one single public phone number: +1 (212) 555-0100.
  • Inside the building, every employee has an internal extension: Alice is ext. 104, Bob is ext. 209.
  • When Alice calls an external restaurant to order lunch, the building's central switchboard intercepts the call, stamps the outgoing caller ID as +1 (212) 555-0100, and records in its private ledger: "Outbound call to pizza shop originated from ext. 104."
  • When the restaurant calls back, they dial +1 (212) 555-0100. The switchboard receptionist checks the ledger, matches the call, and patches the audio directly to Alice's desk phone.
  • This is Port Address Translation (PAT / NAT Overload): thousands of internal private devices sharing a single public address.

• The Infinite Direct Line (The IPv6 Model):

  • Now imagine telephone technology evolves so radically that phone numbers become virtually infinite and free.
  • Every human, smartphone, smart light bulb, and coffee maker on Earth is assigned a permanent, direct, globally dialable phone number.
  • The corporate switchboard receptionist can be fired. Alice talks directly to the restaurant with zero translation, zero address spoofing, and zero middleman delay.
  • This is IPv6: a $128\text{-bit}$ address space so vast ($3.4 \times 10^{38}$ addresses) that every square millimeter of Earth's surface can possess billions of direct, globally unique addresses.

💻 Bridging to Computer Science

To survive the rapid exhaustion of IPv4's 4.3 billion addresses in the late 1990s, the Internet adopted Network Address Translation (NAT, RFC 1631 / RFC 3022) as an emergency stopgap, allowing millions of private RFC 1918 hosts to hide behind a single public IP.

However, NAT was a controversial hack that violated the foundational End-to-End Principle of the Internet. The true, permanent architectural solution is Internet Protocol Version 6 (IPv6), featuring a $128\text{-bit}$ address space and a streamlined, fixed $40\text{-byte}$ header optimized for hardware wire-speed routing.

---

📑Table of Contents

• 🔄 Network Address Translation (NAT & PAT) Mechanics
  • 1. Types of Network Address Translation
  • 2. The NAT Translation Table
  • 3. The Layer-Violating Costs of NAT
• 📐 Visual Blueprint: NAT Address Translation Flow
• 🌌 The IPv6 Architecture & The 128-Bit Universe
  • 1. Hexadecimal Colon Notation
  • 2. The Two Compression Rules:
• ⚡ The Streamlined Fixed 40-Byte IPv6 Header
  • 1. Version (VER - 4 bits)
  • 2. Traffic Class (8 bits)
  • 3. Flow Label (20 bits)
  • 4. Payload Length (16 bits)
  • 5. Next Header (8 bits)
  • 6. Hop Limit (8 bits)
  • 7. Source & Destination Addresses (128 bits each)
• 📊 Complete Field-by-Field Protocol Reference Matrix
• 🔗 IPv6 Extension Headers & Source-Only Fragmentation
  • The End of Router Fragmentation
• ⚖️ Architectural Head-to-Head: IPv4 vs IPv6
• 🏭 Real-World Production Context: Carrier-Grade NAT (CGNAT / Dual-Stack)
  • 1. Carrier-Grade NAT (CGNAT / Large-Scale NAT)
  • 2. Dual-Stack & NAT64 / DNS64
• 📐 Numerical Applications & Worked Examples
  • Example 1: Port Address Translation Capacity
  • Example 2: IPv6 Address Compression and Expansion
  • Example 3: IPv6 Payload vs IPv4 Total Length
• 🎯 Exam & Interview Pitfall Check

---

🔄 Network Address Translation (NAT & PAT) Mechanics

A NAT Gateway (typically your Wi-Fi home router or enterprise firewall) sits on the boundary between a private intranet and the public Internet:

Stage / Direction	Packet Traversal Segment	Source IP:Port	Destination IP:Port	Gateway Action
Outbound Stage 1	Host $\to$ NAT Gateway	192.168.1.10:5000	198.51.100.2:80	Private packet arrives at LAN interface
Outbound Stage 2	NAT Gateway $\to$ WAN	203.0.113.1:40001	198.51.100.2:80	Source rewritten to public IP:Port; session stored
Inbound Stage 3	WAN $\to$ NAT Gateway	198.51.100.2:80	203.0.113.1:40001	Server response arrives at WAN interface
Inbound Stage 4	NAT Gateway $\to$ Host	198.51.100.2:80	192.168.1.10:5000	Destination restored from state table; packet delivered

1. Types of Network Address Translation

• Static NAT: A static 1-to-1 permanent mapping between an internal private IP and an external public IP. Used when an internal server (e.g. an enterprise database or email server) must be accessible from the public Internet.
• Dynamic NAT: Maps private IPs to public IPs on a first-come, first-served basis from a finite pool of registered public addresses. If all public IPs are in use, new outbound sessions are blocked.
• Network Address Port Translation (NAPT / PAT / NAT Overload):
  • The Dominant Standard: Thousands of private hosts share a single registered public IP.
  • The NAT router differentiates between internal connections by allocating unique 16-bit Layer 4 Port Numbers ($2^{16} = 65,536$ concurrent socket combinations).

2. The NAT Translation Table

The heart of a PAT router is its dynamic state table:

Internal IP & Port (Private)	External IP & Port (Public NAT)	Destination Server IP & Port	Protocol	Session State
192.168.1.10 : 54321	203.0.113.1 : 40001	142.250.190.46 : 443	TCP	ESTABLISHED
192.168.1.15 : 54321	203.0.113.1 : 40002	104.244.42.1 : 80	TCP	ESTABLISHED
192.168.1.20 : 61000	203.0.113.1 : 40003	8.8.8.8 : 53	UDP	REPLIED

• Notice that even if Host A (.10) and Host B (.15) transmit using the exact same internal source port (54321), the router maps them to distinct public ports (40001 vs 40002), guaranteeing zero packet collisions upon return.

3. The Layer-Violating Costs of NAT

While NAT saved the Internet from IPv4 exhaustion, systems engineers criticize it for severe architectural drawbacks:

1. Violation of the End-to-End Principle: Routers are Layer 3 devices; they should inspect only L3 headers. NAT forces routers to inspect and modify Layer 4 TCP/UDP port numbers, recalculate transport checksums, and track state.
2. Inbound Connection Barrier: An external machine on the Internet cannot initiate a connection to an internal private host because no entry exists in the NAT table until the internal host speaks first!
3. Breaks Peer-to-Peer Applications: Applications like VoIP (SIP), multiplayer gaming, and WebRTC cannot function without complex NAT Traversal protocols (STUN, TURN, ICE) or Universal Plug and Play (UPnP) port forwarding.

---

📐 Visual Blueprint: NAT Address Translation Flow

Below is an interactive flow diagram tracing the packet header transformation as an internal workstation accesses an external web server through a NAT gateway router:

Architecture Flow

Step 1 of 4

NAT / PAT Packet Header Translation Flow

Tracing source address rewriting on egress and destination address restoration on ingress

💻Private Home LAN (192.168.1.0/24)

🛡️Boundary NAT Router (203.0.113.1)

🌐Public Web (198.51.100.2)

1Outbound SYN

2NAT Rewrite

3Server SYN-ACK

4Inbound Restore

💻Source

Workstation Host

Private: 192.168.1.10:5000

🛡️Table Lookup

NAT / PAT Engine

Maps :5000 -> Public :40001

🖥️Destination

Public Web Server

198.51.100.2:80

💡Click or hover any card or transition arrow above to inspect deep-dive operational mechanics

---

🌌 The IPv6 Architecture & The 128-Bit Universe

Standardized in RFC 8200, IPv6 expands the IP address space from 32 bits to 128 bits: $\text{IPv6 Address Space} = 2^{128} = 340,282,366,920,938,463,463,374,607,431,768,211,456 \approx 3.4 \times 10^{38}\text{ addresses}$

1. Hexadecimal Colon Notation

IPv6 addresses are written as eight groups of four hexadecimal digits (16 bits per group), separated by colons: $2001:0\text{db}8:85\text{a}3:0000:0000:8\text{a}2\text{e}:0370:7334$

2. The Two Compression Rules:

1. Omit Leading Zeroes: Within any 16-bit block, leading zeroes may be omitted: $0000 \implies 0, \quad 0\text{db}8 \implies \text{db}8, \quad 0370 \implies 370$
2. Double Colon (::) Substitution: A single contiguous sequence of one or more blocks of all zeroes can be replaced by ::: $2001:\text{db}8:85\text{a}3::8\text{a}2\text{e}:370:7334$

   ⚠️ RULE: You can use :: at most ONCE in an address to prevent ambiguity.

---

⚡ The Streamlined Fixed 40-Byte IPv6 Header

While the IPv4 header was variable ($20 - 60\text{ bytes}$) with 12 distinct fields, the IPv6 Base Header is locked to a fixed 40 bytes with only 8 fields:

RFC 8200 (IPv6 Standard)Total Packet: Strictly 40 Bytes Fixed (Base Header) • 128-Bit Addressing

IPv6 Base Header Architecture (RFC 8200)

Fixed 40-byte streamlined structure with 128-bit addresses, flow labels, and extension header chaining

Byte 0 (Bits 0–7)Byte 1 (Bits 8–15)Byte 2 (Bits 16–23)Byte 3 (Bits 24–31)

048121620242831

Word 0Bytes 0–3

Version4b

[0–3]

Traffic Class8b

[4–11]6b DSCP + 2b ECN

Flow Label20b

[12–31]20-Bit Flow ID

Word 1Bytes 4–7

Payload Length16b

[0–15]16-Bit Integer

Next Header8b

[16–23]L4 / Ext Code

Hop Limit8b

[24–31]Hop Counter

Words 2–5Bytes 8–23

Source IPv6 Address (128 Bits / 16 Bytes)32b

[0–127]128-Bit Hex Colon

Words 6–9Bytes 24–39

Destination IPv6 Address (128 Bits / 16 Bytes)32b

[0–127]128-Bit Hex Colon

Whole Packet Encapsulation

📦

Chained Extension Headers & Transport PayloadLinked list of Extension Headers (Hop-by-Hop, Routing, Fragment) followed by TCP/UDP Payload

Specified by 16-Bit Payload Length field (up to 65,535 Bytes)

4 BitsBits [0–3]Pattern: 0110 (6)Version

IP Version nibble. Strictly 6 (0110_2) for IPv6.

Hardware Rule:4-bit field identifying the IPv6 protocol suite.

1. Version (VER - 4 bits)

Binary value 0110 ($6_{10}$), identifying IPv6.

2. Traffic Class (8 bits)

Equivalent to IPv4's DSCP and ECN fields, providing Quality of Service (QoS) classification.

3. Flow Label (20 bits)

A major innovation in IPv6! Allows a source to label a sequence of packets belonging to a specific non-default flow (e.g., real-time audio/video streaming). Intermediate routers can forward packets sharing the same Flow Label along identical paths without deep packet inspection.

4. Payload Length (16 bits)

Specifies the length in bytes of everything following the 40-byte base header (includes any IPv6 Extension Headers plus the transport payload). Max: $65,535\text{ bytes}$ (or billions of bytes using the Jumbo Payload hop-by-hop option).

5. Next Header (8 bits)

Replaces IPv4's Protocol field! Specifies either the transport protocol (6 for TCP, 17 for UDP) or the type of the immediate next Extension Header chained behind the base header.

6. Hop Limit (8 bits)

Replaces IPv4's Time-to-Live (TTL). Decremented by 1 at every router hop. When $\text{Hop Limit} == 0$, the packet is discarded and an ICMPv6 Time Exceeded is returned.

7. Source & Destination Addresses (128 bits each)

The full 16-byte logical addresses of sender and recipient.

---

📊 Complete Field-by-Field Protocol Reference Matrix

Below is the definitive reference table compiling all 8 IPv6 base header fields, bit allocations, and crucial differences from IPv4:

Header Field Name	Bit Width	Byte Position	Operational Purpose & Key Differences from IPv4
Version (VER)	4 bits	Byte 0 (Bits 0–3)	Strictly 6 (0110). Identifies IPv6 datagram.
Traffic Class	8 bits	Bytes 0–1 (Bits 4–11)	Packet QoS class (6b DSCP + 2b ECN). Replaces IPv4 Type of Service.
Flow Label	20 bits	Bytes 1–3 (Bits 12–31)	Real-time flow identification for wire-speed forwarding without inspecting L4 headers.
Payload Length	16 bits	Bytes 4–5	Size of payload + extension headers. Excludes the 40-byte base header!
Next Header	8 bits	Byte 6	Protocol multiplexer: specifies L4 protocol (6 TCP, 17 UDP) or chained Extension Header.
Hop Limit	8 bits	Byte 7	Decremented by 1 at every router hop. Discarded at 0 $\\implies$ ICMPv6 Time Exceeded.
Source Address	128 bits	Bytes 8–23	16-byte globally unique logical address of sender.
Destination Address	128 bits	Bytes 24–39	16-byte globally unique logical address of receiver or next routing header hop.

---

🔗 IPv6 Extension Headers & Source-Only Fragmentation

Instead of cramming optional fields into a bulky variable header, IPv6 keeps the base header lean and attaches optional features as Extension Headers chained in a linked list:

📦L3 Base

Base IPv6 Header

Fixed 40 Bytes; Next Header = 0 (Hop-by-Hop)

→

🔗Ext 0

Hop-by-Hop Header

Jumbo payload / router alert; Next Header = 43 (Routing)

→

🔀Ext 43

Routing Header

Source routing specification; Next Header = 6 (TCP)

→

📄L4 Payload

TCP Segment

L4 payload data carrying application byte-stream

The End of Router Fragmentation

• In IPv4, any intermediate router encountering a small MTU link fragments the packet.
• In IPv6, INTERMEDIATE ROUTERS ARE STRICTLY FORBIDDEN FROM FRAGMENTING PACKETS!
• If a packet is too large for a link, the router drops it and returns an ICMPv6 Packet Too Big error message containing the link's MTU.
• The transmitting source host dynamically fragments the payload using an IPv6 Fragment Extension Header, or reduces its TCP Maximum Segment Size. This eliminates massive processing bottlenecks in core transit routers!

---

⚖️ Architectural Head-to-Head: IPv4 vs IPv6

IPv4 vs IPv6 Architectural Deep-Dive

Comparing legacy 1981 design trade-offs with modern 128-bit wire-speed routing foundations

IPv4 Architecture

Internet Protocol Version 4 (RFC 791)

📦

Dominant Architecture / DomainLegacy Internet (Depleted Address Space)

• •32-bit addresses (~4.29 billion total), requiring NAT and private RFC 1918 addresses
• •Variable header length (20 to 60 bytes) due to options, requiring HLEN field
• •Intermediate routers perform packet fragmentation when exceeding MTU
• •Mandatory 16-bit Header Checksum recomputed at every router hop due to TTL decrement
• •Relies on ARP for MAC resolution and broadcast addressing (255.255.255.255)

"Built for a research internetwork: rich in headers, fragile in address scale."

IPv6 Architecture

Internet Protocol Version 6 (RFC 8200)

🚀

Dominant Architecture / DomainModern Internet & Hyperscale Cloud

• •128-bit addresses (3.4 x 10^38), restoring universal direct end-to-end connectivity
• •Fixed 40-byte base header: eliminates HLEN, dramatically speeding up ASIC hardware parsing
• •Routers NEVER fragment: fragmentation performed strictly by source hosts
• •Zero Header Checksum: error detection delegated to Layer 2 and Layer 4
• •Abolished broadcast entirely: uses Multicast, Anycast, and Neighbor Discovery (NDP)

"Built for planetary scale: fixed headers, zero NAT, hardware-native wire speed."

---

🏭 Real-World Production Context: Carrier-Grade NAT (CGNAT / Dual-Stack)

How do mobile telecom operators (T-Mobile, Jio, Verizon) connect 500 million smartphone subscribers when they possess only a few thousand public IPv4 addresses?

📱Mobile Sub

4G/5G Smartphone

Allocated shared Carrier-Grade private IP (RFC 6598: 100.64.0.0/10)

→

🏢CGNAT / LSN

Carrier CGNAT Gateway

Multi-terabit telco appliance translating 100,000+ subscriber sessions to shared public IPs

→

🌐WAN Destination

Public Internet Target

Global Web / Cloud server receiving packets from telco public IPv4 pool

1. Carrier-Grade NAT (CGNAT / Large-Scale NAT)

• Mobile telcos do not assign public IPs to cellular phones.
• They assign private addresses from a dedicated shared space reserved in RFC 6598: 100.64.0.0/10.
• A massive multi-terabit CGNAT Gateway translates traffic from millions of cellular users simultaneously.
• This results in Double NAT: User traffic traverses the home Wi-Fi NAT router, and then immediately traverses the ISP's carrier NAT router!

2. Dual-Stack & NAT64 / DNS64

In modern 5G mobile networks, the cellular core runs on pure IPv6:

• When a smartphone visits an IPv6 server (Google, YouTube), traffic travels directly end-to-end over native IPv6.
• When visiting an old IPv4-only legacy website, the carrier utilizes DNS64 and NAT64 to dynamically translate the IPv6 request into an IPv4 datagram at the edge!

---

📐 Numerical Applications & Worked Examples

Example 1: Port Address Translation Capacity

Problem Statement: A university uses a single public IP address (203.0.113.5) for its campus PAT gateway. The gateway allocates outbound ephemeral port numbers in the range $[40,000 \ \text{to} \ 65,535]$.

1. What is the maximum number of concurrent outbound TCP socket connections the entire university can support simultaneously to a single remote web server (IP: 142.250.190.46, Port: 443)?
2. If students access 500 distinct remote web server destination sockets, how many total simultaneous outbound connections can the PAT router support?

Step-by-Step Solution:

1. Analyze Port Allocation to a Single Destination Socket:

   • Available port range = $[40000, 65535]$.
   • Total assignable source ports on the public IP: $N_{\text{ports}} = 65535 - 40000 + 1 = \mathbf{25,536\text{ ports}}$
   • Because a TCP connection is uniquely identified by the 5-tuple: $(\text{Src IP}, \text{Src Port}, \text{Dst IP}, \text{Dst Port}, \text{Protocol})$
   • When connecting to a fixed destination (142.250.190.46, 443, TCP), each connection must have a unique Source Port.
   • Maximum concurrent connections to that single server = $\mathbf{25,536\text{ connections}}$.

2. Analyze Port Allocation across 500 Distinct Destination Servers:

   • The 5-tuple includes the Destination IP and Port!
   • Therefore, Source Port 40001 can be reused to connect to Server A, Server B, and Server C simultaneously without conflict!
   • Maximum concurrent connections across 500 distinct servers: $\text{Total Connections} = 25,536 \times 500 = \mathbf{12,768,000\text{ connections}} \ (\approx 12.7\text{ Million})$

---

Example 2: IPv6 Address Compression and Expansion

Problem Statement:

1. Compress the following raw IPv6 address into its shortest legal canonical representation: 2001:0000:0000:0045:0000:0000:0000:0001
2. Expand the following compressed IPv6 address back into its full 32-digit hexadecimal representation: fe80::21b:77ff:fecd:9012

Step-by-Step Solution:

1. Compressing 2001:0000:0000:0045:0000:0000:0000:0001:

   • Step A: Strip leading zeroes in every block: 2001:0:0:45:0:0:0:1
   • Step B: Identify zero runs:
     • First run: two blocks of zero (:0:0:)
     • Second run: three blocks of zero (:0:0:0:)
   • Step C: Replace the LONGEST sequence of zeroes with ::: 2001:0:0:45::1
   • (Note: We cannot replace both runs with ::; only one double-colon is legally permitted!)

2. Expanding fe80::21b:77ff:fecd:9012:

   • Count existing groups:
     • Left of ::: fe80 (1 group)
     • Right of ::: 21b, 77ff, fecd, 9012 (4 groups)
     • Total present groups = $1 + 4 = 5\text{ groups}$.
   • Missing zero groups $= 8 - 5 = 3\text{ groups of zeroes}$.
   • Expand :: to 0000:0000:0000: fe80:0000:0000:0000:021b:77ff:fecd:9012
   • Add leading zeroes to restore 4 hex digits per group: $\mathbf{fe80:0000:0000:0000:021b:77ff:fecd:9012}$

---

Example 3: IPv6 Payload vs IPv4 Total Length

Problem Statement: A host generates an application message of $1400\text{ bytes}$ carried over UDP (8-byte header).

1. In IPv4 (no options, 20-byte header), what value is placed in the Total Length field?
2. In IPv6 (no extension headers, 40-byte base header), what value is placed in the Payload Length field?

Step-by-Step Solution:

1. For IPv4:

   • UDP Segment Size $= 1400 + 8 = 1408\text{ bytes}$.
   • IPv4 Total Length counts Header + Data Payload: $\text{Total Length} = 20\text{ (Header)} + 1408\text{ (Data)} = \mathbf{1428\text{ bytes}}$

2. For IPv6:

   • UDP Segment Size $= 1400 + 8 = 1408\text{ bytes}$.
   • IPv6 Payload Length counts strictly what follows the 40-byte base header: $\text{Payload Length} = \mathbf{1408\text{ bytes}}$
   • (The 40-byte base header is NOT included in IPv6's Payload Length!)

---

🎯 Exam & Interview Pitfall Check

Core Conceptual Questions

• Why does IPv6 completely eliminate the broadcast address?
  Broadcast addresses in IPv4 (255.255.255.255 and subnet DBAs) interrupt every single computer on a LAN segment, forcing the CPU of every machine to wake up, process the packet up to Layer 3, and discard it if irrelevant. IPv6 replaced broadcast with Multicast (delivering only to machines subscribed to that specific group) and Anycast (delivering to the closest node among a group). ARP broadcasts were replaced with IPv6 Neighbor Discovery Protocol (NDP) running over targeted Solicited-Node Multicast.

• Can a NAT router support peer-to-peer file sharing or direct video calls without an external relay server?
  Generally no. If both users sit behind distinct NAT routers, neither host knows how to reach the other because both have private IP addresses and both NAT firewalls drop unsolicited inbound packets. Traversal requires an external STUN/TURN server to discover public mappings and relay traffic.

Common Interview Traps

• Trap: Believing IPv6 has a variable header like IPv4.
  Debunked: The base IPv6 header is fixed at strictly 40 bytes. There is no Header Length (HLEN) field in IPv6! Any optional information is carried in separate Extension Headers daisy-chained after the 40-byte base header via the Next Header field.

• Trap: Assuming IPv6 routers fragment packets if the packet exceeds link MTU.
  Debunked: Routers NEVER fragment in IPv6. If a packet exceeds link MTU, the router drops it and transmits an ICMPv6 Packet Too Big error. Fragmentation is performed strictly by the sending host.

---

🗺️View Complete Computer Networks Roadmap & Syllabus

← Previous Topic4.5 IPv4 Datagram Header Format, Flags & Fragmentation MechanicsNext Topic →5.1 Shortest Path Routing: Distance Vector Routing & Bellman-Ford