ELEC3506

Network LayerLecture 522 min

NAT and DHCP

How private addressing and NAT let a whole organisation share a handful of public addresses, and how DHCP hands a joining host one automatically.

By the end of this page you should be able to

  • State the three RFC 1918 private address blocks
  • Trace a NAT translation table entry from an outbound packet through to the matching reply
  • Explain what a NAT router must do to stay transparent to both sides of a connection
  • List the DHCP message exchange and say when the first two steps can be skipped

The idea

An organisation with hundreds of hosts does not need every one of them to hold a scarce, globally routable address — most never talk to the outside world directly. Lecture 5’s own framing: some networks only need addresses to identify hosts within the organisation, and any network number can be used for that, because nothing outside ever needs to see it. That is a private internet, and RFC 1918 sets aside three blocks specifically so organisations can use them without asking anyone’s permission or coordinating with anyone else.

The catch is the lecture states plainly too: hosts using only a private address cannot reach the outside Internet, because private blocks are never advertised as a route. NAT is the fix — one router holds a small number of real, registered addresses, and every private host shares them by having its outbound packets rewritten on the way past.

Private addressing

How it works

RFC 1918 — three blocks, never routed

BlockRangePrefix
Historically "Class A" private10.0.0.0 to 10.255.255.25510/8
Historically "Class B" private172.16.0.0 to 172.31.255.255172.16/12
Historically "Class C" private192.168.0.0 to 192.168.255.255192.168/16
No router on the public Internet will ever advertise a route into these three blocks — that is what makes them safe for any organisation to reuse without coordinating with anyone else.

Using private addresses alone saves the cost of a registered block and saves address space generally, but it comes with the one disadvantage the lecture names directly: every host in the organisation is cut off from the outside Internet, because nothing on the public network knows how to route to a private block.

NAT

How it works

One public address, many private hosts

NAT keeps a translation table mapping each outbound (private source IP, private port) pair to (public NAT address, newly assigned port). To stay transparent to both sides, the lecture lists what the router has to do:

  1. Build an access list of which LAN-side addresses are included in NAT.
  2. Hold a pool of WAN-side public addresses to translate into.
  3. Use both the IP address and the port number for the translation, not the address alone — this is what lets many private hosts share one public address at once.
  4. On every outgoing datagram, replace (source IP, port) with (NAT IP, new port).
  5. Record that mapping in the translation table.
  6. On every incoming datagram, replace the (NAT IP, new port) destination with the matching (source IP, port) pulled from the table.

Worked example

The lecture's own NAT transaction

  1. Host 10.0.0.1, port 3345, sends a datagram to 128.119.40.186, port 80. Source and destination are both ordinary IP addresses from the local network’s point of view.

  2. The NAT router rewrites the source. 10.0.0.1:3345 becomes 138.76.29.7:5001 — the router’s own registered address, paired with a port it assigns for this flow.

  3. The router records the mapping in its translation table: WAN side 138.76.29.7:5001 corresponds to LAN side 10.0.0.1:3345.

  4. The reply arrives addressed to 138.76.29.7:5001. From the outside world’s point of view, that is the only address that ever existed for this conversation.

  5. The router looks up 138.76.29.7:5001 in its table, finds the matching LAN entry, and rewrites the destination back to 10.0.0.1:3345 before delivering it internally.

AnswerOutbound: 10.0.0.1:3345 becomes 138.76.29.7:5001. Reply is translated straight back.

Aside

The lecture adds one detail worth keeping: in practice, the NAT pool’s outside address is normally kept separate from the router’s own outside interface address, rather than reusing it for translated traffic.

Try it

NAT translation table

Try it
Inside localInside globalOutside localOutside global

    Every row exists only because an outbound packet created it. There is no inbound-only entry — that is exactly why an unsolicited packet from outside has nothing to match against.

    Send a few outbound packets from different hosts and watch the table fill in, then try the unsolicited-inbound button — the port on that one is chosen specifically so it matches nothing already in the table.

    Where marks get lost

    NAT breaks unsolicited inbound, by design

    A host behind NAT can start a conversation outward with no trouble — that creates the table entry. What it cannot do is receive a connection nobody inside asked for, because there is nothing in the table to translate against. This is precisely why services run behind NAT (a home web server, for example) need a manually configured port forward: a standing table entry that exists before any outbound packet creates one naturally.

    DHCP

    How it works

    Discover, Offer, Request, ACK

    StepMessageSourceDestinationPurpose
    1DHCP Discover0.0.0.0255.255.255.255 (broadcast)Client looks for any DHCP server
    2DHCP OfferDHCP server, port 67255.255.255.255 (broadcast)Server offers an address, lifetime 3600 seconds
    3DHCP Request0.0.0.0, port 68255.255.255.255 (broadcast)Client asks to use the offered address
    4DHCP ACKDHCP server, port 67255.255.255.255 (broadcast)Server confirms the assignment
    Every message in this exchange is broadcast — the client has no address of its own yet, so it cannot be reached any other way.

    The lecture marks Discover and Offer as skippable, and gives the specific condition rather than leaving it vague: citing RFC 2131 directly, the two steps “can be skipped if a client remembers and wishes to reuse a previously allocated network address.” A brand-new client with no address history always goes through all four steps; a rejoining client that wants its old address back can jump straight to Request.

    AspectStatic configurationDHCP
    Who assigns the addressA sysadmin, hard-coded in a config file (e.g. /etc/rc.config)The network, automatically, when the host joins
    Address reuseHeld permanently, even while the host is offHeld only while connected — freed when the lease ends
    Good fit for mobile hostsNo — the address does not follow the hostYes — designed for hosts that join and leave
    Distinguish these by who does the work and when the address changes hands, not by which one is 'more modern' — the exam phrasing is usually about the mechanism.

    In the exam

    • Know the three RFC 1918 blocks by their exact ranges, not just their prefixes — a question can give you a borderline address like 172.32.0.5 specifically to check whether you know where the block actually ends.
    • NAT translates IP and port, not just IP. That pairing is what allows many private hosts to share one public address simultaneously.
    • Trace a NAT example in both directions. Outbound rewrite, table entry, then the reverse rewrite on the reply — a question can ask for any one step given the others.
    • The Discover/Offer skip condition is specific, not vague. It is “the client remembers and wants to reuse a previous address,” per RFC 2131 as the lecture cites it — not “sometimes” or “on fast networks.”
    • Static vs DHCP is about who assigns and when it changes, not about which is technically superior.

    Check yourself

    1. Which of these addresses falls inside an RFC 1918 private block?
    2. Host 10.0.0.1, port 3345, sends a datagram to 128.119.40.186:80. Following the lecture's own example, what does the NAT router change the source address and port to?
    3. Per Lecture 5's citation of RFC 2131, when can a DHCP client skip the Discover and Offer steps?
    4. An inbound packet arrives at a NAT router with no matching translation table entry. What happens to it?
    5. What disadvantage does Lecture 5 give for private addressing on its own, without NAT?