Network Address Translation and Special Addresses

The global internet connects billions of heterogeneous devices. To achieve seamless end-to-end communication, IP addresses must be unique, universal, and dynamically routable across multiple network boundaries.

1. Overview of IPv4 Addressing and Classless Routing

An IPv4 address is a 32-bit identifier that uniquely and universally defines the connection of a host or router interface to the Internet. The theoretical pool of addresses available is:

$\text{Address Space} = 2^{32} = 4,294,967,296$

Historically, this address space was divided into rigid classes (Classes A, B, C, D, and E) under the system known as Classful Addressing. However, this model caused massive address depletion due to structural inefficiencies:

Class A (/8) blocks allocated $2^{24} = 16,777,216$ addresses to single organizations, leading to millions of wasted addresses.
Class B (/16) blocks allocated $2^{16} = 65,536$ addresses, which was too large for most medium-sized companies but widely over-requested.
Class C (/24) blocks provided only addresses, which was insufficient for many small-to-medium-sized organizations.

1.1 Classless Inter-Domain Routing (CIDR)

To address the rapid depletion of IPv4 addresses, the Internet Engineering Task Force (IETF) introduced Classless Addressing (CIDR) in the mid-1990s. In CIDR, the division between network identifier (prefix) and host identifier (suffix) is variable and represented in slash notation (or CIDR notation), written as:

$\text{IP\_Address} \, / \, n$

where $n$ is the prefix length (representing the number of continuous bits set to 1 in the network mask).

text

32-bit IP Address:
+------------------------------------+------------------------------------+
|          Prefix (n bits)           |         Suffix (32 - n bits)       |
+------------------------------------+------------------------------------+
|  Identifies the Network Block       |  Identifies the Host on Network    |
+------------------------------------+------------------------------------+

1.2 Mathematical Derivations for Block Information

In classless routing, three essential properties define a given block:

The Number of Addresses in the Block ( $N$ ):

$N = 2^{32-n}$
The First Address (Network Address): Found by performing a bitwise logical AND operation between the given IP address and the network mask.

$\text{First Address} = \text{IP Address} \ \& \ \text{Network Mask}$

Step-by-Step Mathematical Example

Consider an IP address in classless notation: 110.23.120.14/20. Let us calculate the block properties:

Find Prefix and Suffix: $n = 20 \implies 32 - n = 12 \text{ bits for hosts}$ $N = 2^{12} = 4096 \text{ addresses}$

2. Subnetting and Hierarchical Address Allocation

Subnetting is the process of dividing a large block of addresses into smaller, distinct sub-blocks (subnets). In CIDR, subnetting is flexible; we can customize subnet boundaries dynamically using Variable-Length Subnet Masking (VLSM).

2.1 Subnet Address Block Assignment Constraints

When an organization is granted a block of addresses, it must allocate addresses to its subnets under strict mathematical constraints:

The number of addresses allocated to any subnet must be a power of 2 ( $2^k$ ).
The subnet mask prefix length $n_{sub}$ is determined by:

$n_{sub} = 32 - \log_2(\text{allocated addresses})$

2.2 Hierarchical Allocation Example

An ISP is allocated a classless block of addresses starting at 190.100.0.0/16 ( $65,536$ addresses). It needs to partition these addresses among three groups of customers:

Group 1: 64 customers, each needing approximately 256 addresses.
Group 2: 128 customers, each needing approximately 128 addresses.
Group 3: 128 customers, each needing approximately 64 addresses.

text

                                [ ISP Block: 190.100.0.0/16 ]
                                             |
                     +-----------------------+-----------------------+
                     |                       |                       |
            [ Group 1 Subblock ]    [ Group 2 Subblock ]    [ Group 3 Subblock ]
               64 Customers            128 Customers           128 Customers
               Each gets /24           Each gets /25           Each gets /26

Let us design the hierarchical allocation:

Group 1 Allocation

Requested: 64 customers $\times$ 256 addresses each = 16,384 addresses.
Subnet Prefix for Group 1 Block:

$n_{\text{group1}} = 32 - \log_2(16384) = 32 - 14 = 18$

Group 2 Allocation

Requested: 128 customers $\times$ 128 addresses each = 16,384 addresses.
Subnet Prefix for Group 2 Block: The next available block starts at 190.100.64.0.

$n_{\text{group2}} = 32 - \log_2(16384) = 18$

Group 3 Allocation

Requested: 128 customers $\times$ 64 addresses each = 8,192 addresses.
Subnet Prefix for Group 3 Block: The next available block starts at 190.100.128.0.

$n_{\text{group3}} = 32 - \log_2(8192) = 32 - 13 = 19$

Total Available Address Analysis

Total Allocated: $16,384 + 16,384 + 8,192 = 40,960$ addresses.
Unused Reserved Space: $65,536 - 40,960 = 24,576$ addresses (starts at to ).

3. Special IP Addresses and Blocks

Certain IPv4 ranges are reserved for special purposes and cannot be assigned to standard host interfaces on the open Internet.

text

Loopback Diagnostics Flow:
   +------------------ Host PC -------------------+
   |  Application (Ping 127.0.0.1)                |
   |     |                                        |
   |     v                                        |
   |  Network Layer (IP Protocol Block)           |
   |     | (Intercepted! Address starts with 127) |
   |     +---------> [ Loopback Path ]            |
   |                         |                    |
   |                         v                    |
   |  Application Receiver Layer                  |
   +----------------------------------------------+
   (Packet never touches the Network Interface Card / Physical Wire)

3.1 Directed Broadcast Address

A Directed Broadcast Address is formed when the network suffix bits are all set to 1. For example, in a local subnet of 192.168.1.0/24, the directed broadcast address is 192.168.1.255.

A host outside this subnet can target this address to distribute a packet to all hosts on that specific remote subnet.
Most modern routers block directed broadcast traffic by default for security reasons (e.g., to prevent Smurf DDoS amplification attacks).

3.2 Private IP Address Space (RFC 1918)

To prevent IPv4 exhaust, private networks use designated non-routable IP addresses internally. These are defined under RFC 1918:

10.0.0.0 to 10.255.255.255 (10.0.0.0/8)
172.16.0.0 to 172.31.255.255 (172.16.0.0/12)
192.168.0.0 to 192.168.255.255 (192.168.0.0/16)

4. Network Address Translation (NAT) Concepts

Since private IP addresses are non-routable on the public Internet, a gateway device must translate these private IP addresses into publicly routable addresses. This process is called Network Address Translation (NAT).

text

               +----------------------- PRIVATE SITE -----------------------+
               | Internal Host: 192.168.1.20                                |
               |                                                            |
               | [Packet] Source IP: 192.168.1.20, Destination IP: 8.8.8.8  |
               +-----------------------------+------------------------------+
                                             |
                                             v
                             +-------------------------------+
                             |    NAT / Gateway Router       |
                             |  Public Interface: 203.0.113.1|
                             |  Private Interface: 192.168.1.1|
                             +---------------+---------------+
                                             |
                                             | (Translates Source IP to Public)
                                             v
               +------------------------ PUBLIC WAN ------------------------+
               | Internet Target Host: 8.8.8.8                              |
               |                                                            |
               | [Packet] Source IP: 203.0.113.1, Destination IP: 8.8.8.8  |
               +------------------------------------------------------------+

4.1 Address Translation Mechanics

When a packet leaves the private network, the NAT-enabled router intercepts the outbound IP packet. It performs the following modifications:

Replaces the Private Source IP Address in the IP header with the public router interface address.
Recalculates the IP header checksum to reflect the modified header field.
Records the translation mapping in its internal NAT Lookup Table.

When a reply arrives at the NAT router from the public internet, the router performs the reverse operation:

Replaces the public destination IP address with the mapped internal private IP address.
Recalculates the IP header checksum.
Forwards the packet down to the local area network.

5. NAT Implementation and Translation Tables

NAT operates in three main configurations: Static NAT, Dynamic NAT, and Port-based Network Address Translation (NAPT).

5.1 Static NAT (1-to-1 Mapping)

In Static NAT, every internal private IP address is statically mapped to a dedicated public IP address. This is typically used for local servers (such as mail or web servers) that need to be reachable from outside the network.

$\text{Private IP } (192.168.1.10) \iff \text{Public IP } (203.0.113.10)$

5.2 Dynamic NAT (IP Pooling Mapping)

In Dynamic NAT, the router maintains a pool of public IP addresses. When an internal host requests a connection to the internet, it is temporarily assigned an available public IP address from the pool.

Limitation: If the pool contains $M$ public addresses, no more than $M$ unique internal hosts can access the external internet at any given time.

5.3 Network Address Port Translation (NAPT / PAT)

Port Address Translation (PAT), also known as Many-to-One NAT, allows multiple internal hosts to share a single public IP address. It achieves this by tracking both IP addresses and transport layer Port Numbers.

text

               NAPT Translation Process:
               -------------------------
               Outbound Packet from Host A:
               [Src IP: 192.168.1.20 | Src Port: 5021] ---> [NAT Router] ---> Public: [Src IP: 203.0.113.1 | Src Port: 12001]
               
               Outbound Packet from Host B:
               [Src IP: 192.168.1.30 | Src Port: 5021] ---> [NAT Router] ---> Public: [Src IP: 203.0.113.1 | Src Port: 12002]

To resolve collisions when two different internal hosts use the same source port number, the NAT router maps the private port number to a unique public port number.

The NAPT Translation Table

The NAPT router maintains a translation table to route packets back to the correct internal hosts.

| Private Source IP | Private Source Port | Public NAT IP | Public NAT Port | Destination IP | Destination Port | | :--- | :--- | :--- | :--- | :--- | :--- | | 192.168.1.20 | 5021 | 203.0.113.1 | 12001 | 8.8.8.8 | 80 | | 192.168.1.30 | 5021 | 203.0.113.1 | 12002 | 8.8.8.8 | 80 | | 192.168.1.40 | 3000 | | | | |

When a packet arrives from the destination host 8.8.8.8 with port 80 to the destination IP 203.0.113.1 with port 12002, the router looks up the port 12002 in its table. It finds that the packet belongs to the internal host 192.168.1.30 at port 5021, translates the destination fields, and forwards the packet.

5.4 NAT Advantages and Disadvantages

Advantages

Conservation of IPv4 Addresses: Thousands of hosts can access the Internet using a single public IP address.
Security: Internal network topologies are hidden from the outside world, preventing external actors from initiating direct connections to internal devices.
Flexibility: Internal addresses can change without requiring updates to public-facing DNS records.

Disadvantages

Performance Overhead: The router must recalculate IP and TCP/UDP checksums for every incoming and outgoing packet, which adds latency.
End-to-End Traceability Loss: Some network security systems require complete trace capability from source to destination, which NAT obscures.
Incompatibility with Certain Applications: Protocols that embed IP addresses inside their payload (e.g., FTP active mode, SIP/VoIP) can fail when routed through a standard NAT gateway without helper modules like Application Layer Gateways (ALGs).

6. Summary

Classless Addressing (CIDR) replaces classful routing by dividing IPv4 addresses into variable prefix and suffix fields, which reduces address waste.
The number of addresses in a block is calculated as $N = 2^{32-n}$ , where $n$ is the prefix length. The first address is the network address, and the last address is the broadcast address.
Special-use blocks (such as the 127.0.0.0/8 loopback block, 255.255.255.255/32 limited broadcast, and RFC 1918 private address ranges) help organize networks and isolate local traffic.
Network Address Translation (NAT) maps private local IP addresses to a single or small pool of public IP addresses, conserving the global IPv4 address space.
Port Address Translation (NAPT / PAT) uses transport layer port numbers to route traffic from multiple internal hosts through a single public IP address.

Assessed progress

Network Address Translation and Special Addresses

Network Address Translation and Special Addresses

1. Overview of IPv4 Addressing and Classless Routing

1.1 Classless Inter-Domain Routing (CIDR)

1.2 Mathematical Derivations for Block Information

Step-by-Step Mathematical Example

2. Subnetting and Hierarchical Address Allocation

2.1 Subnet Address Block Assignment Constraints

2.2 Hierarchical Allocation Example

Group 1 Allocation

Group 2 Allocation

Group 3 Allocation

Total Available Address Analysis

3. Special IP Addresses and Blocks

3.1 Directed Broadcast Address

3.2 Private IP Address Space (RFC 1918)

4. Network Address Translation (NAT) Concepts

4.1 Address Translation Mechanics

5. NAT Implementation and Translation Tables

5.1 Static NAT (1-to-1 Mapping)

5.2 Dynamic NAT (IP Pooling Mapping)

5.3 Network Address Port Translation (NAPT / PAT)

The NAPT Translation Table

5.4 NAT Advantages and Disadvantages

Advantages

Disadvantages

6. Summary

Key Concepts

Classless Inter-Domain Routing (CIDR)

Variable-Length Subnet Masking (VLSM)

Special IP Addresses

Network Address Translation (NAT)

Port Address Translation (NAPT)

Quick Check

Computer Networks

Computer Networks