text:
Strength of materials

The field of strength of materials (also called mechanics of materials) typically refers to various methods of calculating the stresses and strains in structural members, such as beams, columns, and shafts. The methods employed to predict the response of a structure under loading and its susceptibility to various failure modes takes into account the properties of the materials such as its yield strength, ultimate strength, Young's modulus, and Poisson's ratio. In addition, the mechanical element's macroscopic properties (geometric properties) such as its length, width, thickness, boundary constraints and abrupt changes in geometry such as holes are considered.

The theory began with the consideration of the behavior of one and two dimensional members of structures, whose states of stress can be approximated as two dimensional, and was then generalized to three dimensions to develop a more complete theory of the elastic and plastic behavior of materials. An important founding pioneer in mechanics of materials was Stephen Timoshenko.

Definition
In the mechanics of materials, the strength of a material is its ability to withstand an applied load without failure or plastic deformation. The field of strength of materials deals with forces and deformations that result from their acting on a material. A load applied to a mechanical member will induce internal forces within the member called stresses when those forces are expressed on a unit basis. The stresses acting on the material cause deformation of the material in various manners including breaking them completely. Deformation of the material is called strain when those deformations too are placed on a unit basis.

The stresses and strains that develop within a mechanical member must be calculated in order to assess the load capacity of that member. This requires a complete description of the geometry of the member, its constraints, the loads applied to the member and the properties of the material of which the member is composed. The applied loads may be axial (tensile or compressive), or rotational (strength shear). With a complete description of the loading and the geometry of the member, the state of stress and state of strain at any point within the member can be calculated. Once the state of stress and strain within the member is known, the strength (load carrying capacity) of that member, its deformations (stiffness qualities), and its stability (ability to maintain its original configuration) can be calculated.

The calculated stresses may then be compared to some measure of the strength of the member such as its material yield or ultimate strength. The calculated deflection of the member may be compared to deflection criteria that are based on the member's use. The calculated buckling load of the member may be compared to the applied load. The calculated stiffness and mass distribution of the member may be used to calculate the member's dynamic response and then compared to the acoustic environment in which it will be used.

Material strength refers to the point on the engineering stress–strain curve (yield stress) beyond which the material experiences deformations that will not be completely reversed upon removal of the loading and as a result, the member will have a permanent deflection. The ultimate strength of the material refers to the maximum value of stress reached. The fracture strength is the stress value at fracture (the last stress value recorded).

Types of loadings

 * Transverse loadings – Forces applied perpendicular to the longitudinal axis of a member. Transverse loading causes the member to bend and deflect from its original position, with internal tensile and compressive strains accompanying the change in curvature of the member. Transverse loading also induces shear forces that cause shear deformation of the material and increase the transverse deflection of the member.
 * Axial loading – The applied forces are collinear with the longitudinal axis of the member. The forces cause the member to either stretch or shorten.
 * Torsional loading – Twisting action caused by a pair of externally applied equal and oppositely directed force couples acting on parallel planes or by a single external couple applied to a member that has one end fixed against rotation.

Stress terms

Uniaxial stress is expressed by

\sigma = \frac{F}{A}

$$ where F is the force [N] acting on an area A [m2]. The area can be the undeformed area or the deformed area, depending on whether engineering stress or true stress is of interest.

 * Compressive stress (or compression) is the stress state caused by an applied load that acts to reduce the length of the material (compression member) along the axis of the applied load, it is, in other words, a stress state that causes a squeezing of the material. A simple case of compression is the uniaxial compression induced by the action of opposite, pushing forces. Compressive strength for materials is generally higher than their tensile strength. However, structures loaded in compression are subject to additional failure modes, such as buckling, that are dependent on the member's geometry.
 * Tensile stress is the stress state caused by an applied load that tends to elongate the material along the axis of the applied load, in other words, the stress caused by pulling the material. The strength of structures of equal cross-sectional area loaded in tension is independent of shape of the cross-section. Materials loaded in tension are susceptible to stress concentrations such as material defects or abrupt changes in geometry. However, materials exhibiting ductile behaviour (most metals for example) can tolerate some defects while brittle materials (such as ceramics) can fail well below their ultimate material strength.
 * Shear stress is the stress state caused by the combined energy of a pair of opposing forces acting along parallel lines of action through the material, in other words, the stress caused by faces of the material sliding relative to one another. An example is cutting paper with scissors or stresses due to torsional loading.

Stress parameters for resistance
Material resistance can be expressed in several mechanical stress parameters. The term material strength is used when referring to mechanical stress parameters. These are physical quantities with dimension homogeneous to pressure and force per unit surface. The traditional measure unit for strength are therefore MPa in the International System of Units, and the psi between the United States customary units. Strength parameters include: yield strength, tensile strength, fatigue strength, crack resistance, and other parameters.

 * Yield strength is the lowest stress that produces a permanent deformation in a material. In some materials, like aluminium alloys, the point of yielding is difficult to identify, thus it is usually defined as the stress required to cause 0.2% plastic strain. This is called a 0.2% proof stress.

 * Compressive strength is a limit state of compressive stress that leads to failure in a material in the manner of ductile failure (infinite theoretical yield) or brittle failure (rupture as the result of crack propagation, or sliding along a weak plane – see shear strength).
 * Tensile strength or ultimate tensile strength is a limit state of tensile stress that leads to tensile failure in the manner of ductile failure (yield as the first stage of that failure, some hardening in the second stage and breakage after a possible "neck" formation) or brittle failure (sudden breaking in two or more pieces at a low-stress state). The tensile strength can be quoted as either true stress or engineering stress, but engineering stress is the most commonly used.
 * Fatigue strength is a more complex measure of the strength of a material that considers several loading episodes in the service period of an object, and is usually more difficult to assess than the static strength measures. Fatigue strength is quoted here as a simple range ($$\Delta\sigma= \sigma_\mathrm{max} - \sigma_\mathrm{min}$$). In the case of cyclic loading it can be appropriately expressed as an amplitude usually at zero mean stress, along with the number of cycles to failure under that condition of stress.

 * Impact strength is the capability of the material to withstand a suddenly applied load and is expressed in terms of energy. Often measured with the Izod impact strength test or Charpy impact test, both of which measure the impact energy required to fracture a sample. Volume, modulus of elasticity, distribution of forces, and yield strength affect the impact strength of a material. In order for a material or object to have a high impact strength, the stresses must be distributed evenly throughout the object. It also must have a large volume with a low modulus of elasticity and a high material yield strength.

Strain parameters for resistance

 * Deformation of the material is the change in geometry created when stress is applied ( as a result of applied forces, gravitational fields, accelerations, thermal expansion, etc.). Deformation is expressed by the displacement field of the material.
 * Strain or reduced deformation is a mathematical term that expresses the trend of the deformation change among the material field. Strain is the deformation per unit length. In the case of uniaxial loading the displacement of a specimen (for example a bar element) lead to a calculation of strain expressed as the quotient of the displacement and the original length of the specimen. For 3D displacement fields it is expressed as derivatives of displacement functions in terms of a second order tensor (with 6 independent elements).
 * Deflection is a term to describe the magnitude to which a structural element is displaced when subject to an applied load.

Stress–strain relations
The slope of this line is known as Young's modulus, or the "modulus of elasticity". The modulus of elasticity can be used to determine the stress–strain relationship in the linear-elastic portion of the stress–strain curve. The linear-elastic region is either below the yield point, or if a yield point is not easily identified on the stress–strain plot it is defined to be between 0 and 0.2% strain, and is defined as the region of strain in which no yielding (permanent deformation) occurs.
 * Elasticity is the ability of a material to return to its previous shape after stress is released. In many materials, the relation between applied stress is directly proportional to the resulting strain (up to a certain limit), and a graph representing those two quantities is a straight line.

 * Plasticity or plastic deformation is the opposite of elastic deformation and is defined as unrecoverable strain. Plastic deformation is retained after the release of the applied stress. Most materials in the linear-elastic category are usually capable of plastic deformation. Brittle materials, like ceramics, do not experience any plastic deformation and will fracture under relatively low strain, while ductile materials such as metallics, lead, or polymers will plastically deform much more before a fracture initiation.

Consider the difference between a carrot and chewed bubble gum. The carrot will stretch very little before breaking. The chewed bubble gum, on the other hand, will plastically deform enormously before finally breaking.

Design terms
Ultimate strength is an attribute related to a material, rather than just a specific specimen made of the material, and as such it is quoted as the force per unit of cross section area (N/m2). The ultimate strength is the maximum stress that a material can withstand before it breaks or weakens. For example, the ultimate tensile strength (UTS) of AISI 1018 Steel is 440 MPa. In Imperial units, the unit of stress is given as lbf/in2 or pounds-force per square inch. This unit is often abbreviated as psi. One thousand psi is abbreviated ksi.

A factor of safety is a design criteria that an engineered component or structure must achieve. $$FS = UTS/R$$, where FS: the factor of safety, R: The applied stress, and UTS: ultimate stress (psi or N/m2)

Margin of Safety is also sometimes used to as design criteria. It is defined MS = Failure Load/(Factor of Safety × Predicted Load) − 1.

For example, to achieve a factor of safety of 4, the allowable stress in an AISI 1018 steel component can be calculated to be $$R = UTS/FS$$ = 440/4 = 110 MPa, or $$R$$ = 110×106 N/m2. Such allowable stresses are also known as "design stresses" or "working stresses".

Design stresses that have been determined from the ultimate or yield point values of the materials give safe and reliable results only for the case of static loading. Many machine parts fail when subjected to a non-steady and continuously varying loads even though the developed stresses are below the yield point. Such failures are called fatigue failure. The failure is by a fracture that appears to be brittle with little or no visible evidence of yielding. However, when the stress is kept below "fatigue stress" or "endurance limit stress", the part will endure indefinitely. A purely reversing or cyclic stress is one that alternates between equal positive and negative peak stresses during each cycle of operation. In a purely cyclic stress, the average stress is zero. When a part is subjected to a cyclic stress, also known as stress range (Sr), it has been observed that the failure of the part occurs after a number of stress reversals (N) even if the magnitude of the stress range is below the material's yield strength. Generally, higher the range stress, the fewer the number of reversals needed for failure.

Failure theories
There are four failure theories: maximum shear stress theory, maximum normal stress theory, maximum strain energy theory, and maximum distortion energy theory. Out of these four theories of failure, the maximum normal stress theory is only applicable for brittle materials, and the remaining three theories are applicable for ductile materials. Of the latter three, the distortion energy theory provides most accurate results in a majority of the stress conditions. The strain energy theory needs the value of Poisson's ratio of the part material, which is often not readily available. The maximum shear stress theory is conservative. For simple unidirectional normal stresses all theories are equivalent, which means all theories will give the same result.

 * Maximum Shear Stress Theory – This theory postulates that failure will occur if the magnitude of the maximum shear stress in the part exceeds the shear strength of the material determined from uniaxial testing.
 * Maximum Normal Stress Theory – This theory postulates that failure will occur if the maximum normal stress in the part exceeds the ultimate tensile stress of the material as determined from uniaxial testing. This theory deals with brittle materials only. The maximum tensile stress should be less than or equal to ultimate tensile stress divided by factor of safety. The magnitude of the maximum compressive stress should be less than ultimate compressive stress divided by factor of safety.
 * Maximum Strain Energy Theory – This theory postulates that failure will occur when the strain energy per unit volume due to the applied stresses in a part equals the strain energy per unit volume at the yield point in uniaxial testing.
 * Maximum Distortion Energy Theory – This theory is also known as shear energy theory or von Mises-Hencky theory. This theory postulates that failure will occur when the distortion energy per unit volume due to the applied stresses in a part equals the distortion energy per unit volume at the yield point in uniaxial testing. The total elastic energy due to strain can be divided into two parts: one part causes change in volume, and the other part causes change in shape. Distortion energy is the amount of energy that is needed to change the shape.
 * Fracture mechanics was established by Alan Arnold Griffith and George Rankine Irwin. This important theory is also known as numeric conversion of toughness of material in the case of crack existence.

A material's strength is dependent on its microstructure. The engineering processes to which a material is subjected can alter this microstructure. The variety of strengthening mechanisms that alter the strength of a material includes work hardening, solid solution strengthening, precipitation hardening, and grain boundary strengthening and can be quantitatively and qualitatively explained. Strengthening mechanisms are accompanied by the caveat that some other mechanical properties of the material may degenerate in an attempt to make the material stronger. For example, in grain boundary strengthening, although yield strength is maximized with decreasing grain size, ultimately, very small grain sizes make the material brittle. In general, the yield strength of a material is an adequate indicator of the material's mechanical strength. Considered in tandem with the fact that the yield strength is the parameter that predicts plastic deformation in the material, one can make informed decisions on how to increase the strength of a material depending its microstructural properties and the desired end effect. Strength is expressed in terms of the limiting values of the compressive stress, tensile stress, and shear stresses that would cause failure. The effects of dynamic loading are probably the most important practical consideration of the strength of materials, especially the problem of fatigue. Repeated loading often initiates brittle cracks, which grow until failure occurs. The cracks always start at stress concentrations, especially changes in cross-section of the product, near holes and corners at nominal stress levels far lower than those quoted for the strength of the material.

title: Strength of materials


text:
User:DrewJ

otherwise known as thecommissioner@hotmail.com interstes inlcude perl, structural engineering, driving and cooking. I have a lot to say about the history of WWII.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: User:DrewJ


text:
Human Rights in China (organization)

Human Rights in China is a New York–based international, Chinese, non-governmental organization with intentions to promote international human rights and facilitate the institutional protection of these rights in the People's Republic of China. HRIC is a member organization of the International Federation for Human Rights. According to Fang Lizhi, HRIC is committed to an independent, non-political, and intelligent approach

Founded by Chinese students and scholars in March 1989, HRIC [Human Rights In China] implements programs to generate infrastructural change in China while also engaging in advocacy strategies on behalf of individuals living in China.

With offices in Hong Kong and New York City, HRIC serves as a source of analysis and information on the human rights situation in China, as well as an active NGO advocate in the international arena. In 2005, HRIC was also recognized for its creative and effective use of technology by The Tech Museum of Innovation as one of twenty-five Tech Award Laureates of the year.

HRIC's Executive Director is Zhou Fengsuo (2023-present). Its former Executive Directors are Sharon Hom (2002-2023) and Xiao Qiang (1991-2002).

Program
HRIC links individual advocacy with systemic and policy interventions addressing human rights, technology, legal and administrative reform issues. HRIC's core programs and reports address human rights violations affecting China's rural population, migrant workers, ethnic minorities, women, and children.

Domestic advocacy
HRIC's domestic work with political prisoners provides support for legal representation and assistance to activists in China. HRIC works with domestic Chinese groups internationally and domestically in calling upon the Chinese government to engage in a constructive reassessment of the 1989 Tiananmen Square protests and massacre and to move toward greater reforms and social stability.

By supporting domestic groups such as the Tiananmen Mothers, HRIC links Chinese calls for redress to current international debates such as lifting the European Union arms embargo on China. HRIC's online June 4 Archive, is a Chinese-language archive documenting the history of the 1989 Tiananmen democracy movement. HRIC also maintains Fill the Square, an online petition mobilizing individuals and organizations worldwide to support the Tiananmen Mothers' demands for accountability for the June Fourth crackdown.

International advocacy
HRIC's advocacy initiatives contribute to multilateral and bilateral human rights policy discussions, analyses, and recommendations. HRIC provides briefings and reports to United Nations bodies, international conferences, WTO processes, and the EU-China Dialogue. As of 2006, HRIC has submitted over 40 individual cases of the victims of human rights abuses to the UN Working Group on Arbitrary Detention; 13 of the cases have had decisions made on them, and all of the 13 have been deemed arbitrary.

HRIC regularly addresses the relationship between corporate social responsibility, trade, and human rights through reports, briefings, and presentations, thus contributing to a global framework that respects and promotes human rights. HRIC has outlined a best practices matrix for IT companies doing business in China involving information communication technology (ICT), surveillance and security, multilaterals, the media, governments, and NGOs.

Online advocacy
HRIC's online advocacy project supports Chinese citizens' increasing activism and promotes the free flow of information in China by building a technology platform that uses proxy server technology and a biweekly e-newsletter sent to hundreds of thousands of subscribers in China. The project includes the development of six interrelated Web sites with online Chinese publications, tools for accountability, and advocacy resources.

Ongoing publications
China Rights Forum is HRIC's bilingual semiannual journal. Since its founding in 1990, it has covered a range of issues regarding China's human rights developments. It includes articles from Chinese scholars, artists, writers and activists promoting democratic reform, labor rights, freedom of expression, and the rights of religious and ethnic minorities and disadvantaged groups. Archives of the articles are available online.

China Human Rights Biweekly (中国人权双周刊) is a Chinese-language biweekly journal publishing in-depth analyses, current events commentaries, theoretical discussions, and law reviews, in addition to news from China that has been banned and censored in the mainland. Issues covered have included torture and corruption in China, Internet censorship, and China's legal system. The majority of the contributors and readers are mainland Chinese Internet users.

Daily News Brief is HRIC's daily news roundup.

Reports
HRIC has published thematic reports and briefings, issues backgrounders, and short reports on topics involving ethnic minorities, women and children, control of the media, labor rights and state secrets, legal reform, and social unrest. HRIC also issues long reports on human rights issues and circulates them to multilateral bodies, media, policy makers, governments, and NGOs.

Funding
HRIC is funded by private foundations and individuals from Europe, Asia, and North America. Since it was founded, HRIC has obtained support from groups including the National Endowment for Democracy, Open Society Institute, the International Centre for Human Rights and Democratic Development, the European Human Rights Foundation, Human Rights Watch, and Asia Watch. In 2006, the New York University School of Law honored Robert L. Bernstein by establishing the Robert L. Bernstein Fellowship in International Human Rights which supports an annual, one-year fellowship for recent graduates to work with the NGO.

title: Human Rights in China (organization)


text:
Connect

Connect may refer to:

Albums

 * Connect (Sick Puppies album), 2013
 * Connect (Charles Tolliver album), 2020
 * Connect, album by Mark Farina
 * Tha Connect, a 2009 album by Willy Northpole
 * Connect, a 2009 album by Dave Schulz (musician)
 * Connect Sets (disambiguation), several album series

Songs

 * "Connect" (song), a 2011 song by ClariS
 * "Connect", a song by Sick Puppies from their 2013 album Connect
 * "Connect", song by Drake from the 2013 album Nothing Was the Same

Other music

 * Connect Music Festival, a music festival in Inveraray, Scotland
 * Sony Connect, an online music store

Other entertainment

 * Connect, a matching game similar to dominoes, also known as Rivers, Roads & Rails
 * Connect (sculpture), a public art work by Jeremy Wolf installed Milwaukee, Wisconsin, United States
 * Connect (2019 film), a Scottish film
 * Connect (2022 film), a Tamil horror thriller film
 * Connect with Mark Kelley, a Canadian news talk show
 * Connect (TV series), South Korean TV series

Cars

 * Connect (Alfa Romeo), control system
 * Ford Tourneo Connect, a vehicle manufactured in the UK by Ford
 * Ford Transit Connect, a vehicle manufactured in the UK by Ford

Computing and technology

 * Connect (computer system), HMRC data mining database system (UK)
 * CONNECT (HTTP), the request method of the Hypertext Transfer Protocol
 * Communications, Navigation, and Networking reConfigurable Testbed (CoNNeCT), a testbed for the Space Communications and Navigation Program (SCaN) program on the International Space Station
 * CONNECT string, a Hayes modem command and response
 * McGraw-Hill Connect, a web-based assignment and assessment platform that helps educators connect students to their coursework

Organizations

 * Connect (financial services company), a consumer credit reporting agency in the United States
 * Connect (Irish trade union), a union for construction and technical workers in Ireland
 * Connect (organization), an independent non-profit organization servicing the San Diego region with offices in San Diego and Washington, D.C.
 * Connect (UK trade union), a union for technology workers in the United Kingdom
 * Connect (users group), the worldwide users group for Hewlett-Packard
 * Connect (insurance company), an American insurance company
 * Directorate-General for Communications Networks, Content and Technology, or Connect, a department of the European Commission

Other uses

 * Connect (horse), a grade 1 winning thoroughbred
 * Connect (studio), a Japanese anime studio

title: Connect


text:
Talk:Network address translation

Lead too long and technical
The lead is too long and contains too much technical content. This content would be better suited as being rewritten and placed in its own (or another) section. The lead should be written so that it is as less technical as possible.

The lead is messy because it is long. The lead should summarise key points in the article and provide a brief overview of what NAT is and/or does, rather than being a commentary on all the technical background.

--Hrbm14 (talk) 03:27, 5 February 2015 (UTC)

Distinction between NAT and stateful firewalling
From the Benefits section of the article, it claims that "[NAT] can enhance the reliability of local systems by stopping worms and enhance privacy by discouraging scans" - this is not a function of NAT at all but a stateful firewall. NAT doesn't magically protect clients behind the LAN from receiving packets from the Internet to the private address space unless the firewall on the router rejects such packets. By the same token, a network of fully public IP space (such as a DMZ) can have the same benefit by having the router block unwanted connections from the outside based on connection state. NAT is not the same as a firewall, although it is commonly used in combination with one. I'd like to make a distinction in the article between benefits (such as load balancing, failover, and other such uses mentioned further down in the article) and perceived benefits such as the concept of a so-called 'NAT firewall'. As I look for a good reference or two to add in with my edits (feel free to suggest some if anyone has good links,) I'd like to give people who disagree a chance to say so so we can discuss why NAT isn't a firewall. A couple comments on this talk page seem to ignore this which is why I bring it up here first. Pekster (talk) 00:02, 27 May 2008 (UTC)

 * I agree that NAT on its own cannot act in the way you quoted. In a home or end-user network, NAT is almost universally provided by a firewall; but there is no reason why this has to be the case, and in large networks it is not uncommon to see NAT being used where no other operations are involved. You can only have the common "NAT firewall" with some level of stateful inspection, and the simplest version of this is often the home DSL router, which blocks all incoming traffic, unless it is a reply to an outgoing NATted connection; and generally with only one external IP address that's not just NAT, it's probably PNAT (a lot of users have only one device connected to their routers, in which case they don't need PNAT, but it's usually possible to connect multiple devices to the private side, in which case of course, PNAT is required). YojimboSan (talk) 08:25, 22 June 2008 (UTC)

Missing a Section for References Cited
Citations like appear in the article itself, but clicking the links lead to nothing and there is no section at the bottom of the page which lists them all. I am not sure if I'm mistaken or what sort of malfunction this is but this seems to be very bad for the article! 07 08 31 —Preceding unsigned comment added by 68.144.16.61 (talk) 19:00, August 30, 2007 (UTC)

Vagueness and ambiguity...
"According to specifications, routers should not act in this way..." - which specifications? RFCs??

style
This article has a "lot" of useless "quotes" that should be "removed".

It would be nice if the note that the STUN classification had been abandoned was in the introductory paragraph of the section Different types of NAT, rather than the concluding one. Having carefully read through trying to understand, to find out it's no longer used is frustrating. Also, the diagrams in this section draw the eye first and can mislead readers into believing that these diagrams explain NAT, when in fact they only explain the outmoded classification system. DarkJMKnight 19:08, 9 February 2007 (UTC)

asynchronous nat
anyone got any references for this term. my guess is it reffers to a setup with 1:1 nat that doesn't do anything statefull at all but just changes the ips. Plugwash 02:39, 24 Jun 2005 (UTC) bhcshffszhcvzfjhf good —Preceding unsigned comment added by 125.19.8.154 (talk) 15:35, 29 December 2010 (UTC)

mistake?
layer 3? The article says "Some higher-layer protocols (such as FTP, Quake, and SIP) send layer-3 information inside IP datagram payloads. FTP in active mode, for example, uses separate ports for control traffic (commands) and for data traffic (file transfers)." This is correct, there is the NAT/PAT problem with protocols like FTP, though port information included in FTP packets are concerning the TCP port and hence are layer-4, or did I miss something?

 * Actually, FTP in old default mode "passive" does not bother to pass the layer 4 port number, but relies on the other end to use the layer 3 IP address to contact predefined TCP port 20 (in reverse direction). Usually connect request to the port 20 of the outside of the NAPT will not be translated to the originators inside IP and TCP port 20 ... except if there is a DMZ FTP server defined for the NAPT. Seikku Kaita (talk) 14:08, 6 October 2010 (UTC)

Clarified: Yes, the text was a bit inaccurate. Both layer 3 and layer 4 data are subject to being invalidated by passing through NAT, depending on whether port translation is also in use. I hope the text is now clearer. Mditto 01:25, 18 November 2005 (UTC)

Yes, a better example of layer 3 protocol information issues with NAT would be SIP which can include the IP address of a caller in a SIP invite sent to a call recipient from a SIP Proxy. —Preceding unsigned comment added by Owendelong (talk • contribs) 18:54, 11 September 2009 (UTC)

typo in the PDF linked at the article
The external link http://list.sipfoundry.org/archive/ietf-behave/pdf00000.pdf provides a really good example but unfortunately it seems to have some mistakes in the diagram: the destination address:port D keeps the value 1.1.1.5 at the private host while it should be D=1.1.1.6 Probably a typo, but very confusing one..

I don't like the fact that an external pdf is linked in the text. --Ggonnell 17:54, 1 April 2006 (UTC)
 * I agree. The first person ("I would respectfully...") needs to go too. --Chris (talk) 20:22, 15 May 2006 (UTC)

 * I worked on that section. The whole section is so specific that it may not be appropriate for an encyclopedia article. JonHarder 22:04, 15 May 2006 (UTC)

Citations/copyright
The following statements need citations:

 * "according to specifications, routers should not act in this way": which specifications? This sentence implies that NATting is frowned upon whereas I think it's generally accepted as necessary given the limitations of IPv4 address allocation.

 * "this classification is now abandoned": I don't think this is true. It is still useful e.g. as a way for a STUN client to tell an application about the network it's on.

Also, the majority of the text of classification section is taken directly from RFC 3489.

Daf 16:00, 16 September 2006 (UTC)

NAT and security
Some note could/should be added about NAT not bringing any security contrary to popular belief ýThe preceding unsigned comment was added by 130.233.243.229 (talk) 07:47, 11 December 2006 (UTC).

 * NAT add security. Common NAT are very similar to restrictive inbound firewall. In the home usage (without servers) it avoid external connection to any local machine, so user can be "infected" only by going into wrong hosts/sites (malice, ignorance, spoofing, cross scripts,...).  So it is one security measure.  Cate |Talk 09:47, 11 December 2006 (UTC)

I think this also applies in the IPV6 case. The statement that NAT isn't useful in connection with IPV6 ignores the natural firewall provided by a default SNAT router configuration installed by a consumer ignorant of how to configure firewall rules (unless we know that all consumer grade IPV6 routers will block incoming server connections by default which seems very unlikely).Copsewood 19 Jan 07

Add "Hairpins and Determinism" Hairpin operation - a local host directs a packet to the public address and port of an already mapped local host and to its own mapped address and port. The NAT bindings are available to either side of the NAT

Nondeterministic NATs change their binding behavior when there is a binding conflict. Some NATs attempt to preserve the port address in the binding, so that the local source port and the externally bound port are the same whenever possible. If another local host obtains a NAT binding using the same source port number, then the behavior of the NAT for this conflicting port binding may differ from that where the port number is preserved. In some cases the behavior of NAT for the first connection is that of a full cone, or a restricted cone, while the NAT behaves in a symmetric fashion for the secondary instance where the port number has been mapped to a new value by the NAT.

It is also possible that the NAT may elect to preserve the binding in any case, and remove the current binding and replace it with a new binding that refers to the most recent packet that the NAT has processed.

All these behaviors can be classified as nondeterministic, in that the NAT behavior becomes one that is determined by the order of outbound traffic.

Port preservation, Port overloading, Port multiplexing Binding Timer Refresh: Bidirectional, Outbound, Inbound, Transport Protocol state Larytet

NAT as network administration tool
I think not only NAT as security tool should be mentioned, as requested above, but using NAT as admin tool is also missing.

I think, "NAT because of IP address shortage" is just ONE single exceptional application (of course, this one application is used in millions of installations behind dialups and alike).

For instance, it might be helpful when upgrading servers without letting clients taking notice or adding "compatiblity modes" when moving / restructuring networks. If for instance, the IPs of a subnet are changed, for a while NAT can be applied to catch missconfigurations without disturbing users. Admins can monitor log files / IDS to detect and fix this, finally removing NAT when everthing is tested and working.

Even when linking some home private networks via VPN or so, NAT may help (192.168.1.0/24 is widely used :-)).

-- Steffen http://de.wikipedia.org/wiki/User:STD

Unclear Types-of-NAT Diagrams
As a NAT novice, I have been unable to work out which side is internal and which is external. This information needs to be added to each diagram (or at least a note at the section beginning) ýThe preceding unsigned comment was added by Dorcots (talk " contribs) 08:23, 6 February 2007 (UTC).

If each of semicircles represents a port, then diagrams and descriptions contradict one another. —Preceding unsigned comment added by 91.195.22.32 (talk) 15:17, 17 February 2009 (UTC)

Agree, the diagrams should be labelled or redrawn. Thanks. — Preceding unsigned comment added by 116.199.214.34 (talk) 01:59, 30 May 2012 (UTC)

As 91.195.22.32 says, purpose of semicircles is not given, but only the ports make the sense. Then it completely doesn't correspond to explanation! Secondly, behind NAT there is more devices, but here is only one. That's confusing, it makes feeling that there's enough space for port mapping. Koko7 (talk) 11:23, 13 September 2012 (UTC)

Here are correct ASCII style diagrams. Mpb2 (talk) 01:15, 23 March 2014 (UTC)

Unprintable diagrams?
I tried printing a couple of different ways, but the "Different types of NAT" diagrams come out with a solid black background. Is there something that can be changed to make them display right universally? DKEdwards 22:35, 19 June 2007 (UTC)

Origins
The most common form of NAT today is one-many (ie one to many) NAT. I remember many-many NAT being around by 1994 in (IIRC) Solaris but the first one-many NAT I know of was the "IP Masquerade" code under Linux, first introducted in the 1.1 kernel IIRC. I've RTFMed on this in the past and have not found a definitive answer. Did anyone implement one-many NAT before the Linux IP Masquerade authors around 1994-1995? If we can get a bit of history on the origins of one-many and many-many it would be a good addition to the article. Robert Brockway 22:21, 15 February 2007 (UTC)

 * Echoing this rather old complaint. There's nothing in the article about the history of NAT. When were the techniques first described? When were they implemented in various systems? When did it become commonplace? --Bigpeteb (talk) 17:58, 1 May 2014 (UTC)

 * I agree that this article needs more about the history of NAT, so I started a "History" section with what little I know. Improvements are welcome. --DavidCary (talk) 04:19, 5 November 2023 (UTC)

 * Thanks for the contribution. There was some non-history content in that so I've trimmed it back. ~Kvng (talk) 13:58, 7 November 2023 (UTC)

Missing Drawback: Port Shortage?
While this problem rarely occurs, it can reach serious dimensions, including total denial of service for internet conections from a private network - and it is real.

As the NAT router reserves allocates an individual port for each outgoing connection, a huge number of outgoing connection may saturate the range of available ports. As ports typically get freed when the connection doesn't produce any more traffic for a certain time (TTL, ot "time to live"), the maximum number of connection is limited to approximately to 64K/TTL.

Not an issue in most cases, I agree. However, there are two possible situations worth mentioning:

1. the LAN has a real large number of machines which open connections to the internet,

2. one machine in the LAN opens an abundance of connections to the internet.

In case 2, a single machine may be sufficient to cause denial of service. Note that case 2 will most likely be caused by some faulty software, but it may still disable the complete internet access of a company (until the tech guys find out what's going on...).

I experienced case 2 a few times arleady. Most unpleasant situation, I might add.

Maybe someone with somehow more insight than me could cast this into reasonable words to suit the article? TIA! --80.134.62.42 20:51, 13 May 2007 (UTC)

Who invented NAT?
And where did it come from? Bilge [ TC] 14:14, 24 May 2007 (UTC)

 * I don't think there is consensus over this subject. As far as I understand, there's is not a single RFC or Internet-Draft defining a NAT. Don't get me wrong, there is a number of RFCs and I-Ds that discuss the already deployed "legacy" NATs, their individual behaviors and effect on the Internet - especially their negative effect of the NATs on the end-to-end principle. These documents, however, have emerged after NATs have been deployed. During the past decade or so, Network Address Translators have become popular as a way to deal with the public IPv4 address shortage. Thus the NATing property has just been embedded to routers as a quick cure. There was probably no discussion on what would be the effects on the Internet as a whole. I suppose it was all ok for the deployers of NATing routers just as long as the company behind the NAT would get enough computers connected to the Internet with minimal financial efforts. To answer your question: no one knows. --Siipikarja ♫ 13:31, 25 February 2008 (UTC)

 * Surprise: no one claims to have invented this kludge which goes against one of the founding principle of the Internet. Or maybe some patent company will in the future. Marchash (talk) 13:33, 2 October 2009 (UTC)

 * It is odd that no-one has claimed the honor, for this great idea of getting rid of the firewall proxies there used to be before NAT. This ridiculous attitude of calling NAT a kludge and whining about so-called founding principles of Internet is void as far as there are 70% of happy Internet users behind a NAT. Calling windshield a kludge against founding principles of insects flying into your eye does not make the invention of windshield any worse, people will continue to use it. Seikku Kaita (talk) 08:54, 21 November 2010 (UTC)
 * If you have public IPs on internal networks you never had to have proxies, just little holes in the firewall. You only (still) need to have an application proxy if you're doing something more involved. The necessity to proxy every single port is a direct result of using NAT. As for the users being happy ... well as long as they stay good little consumers they may be, but many games nowadays need 'ports opened' and directed to the ONE PC that can play the game. Opening ports is a minor pain, "ONE PC" will make them very unhappy. I wouldn't be surprised if games (and other apps) start to appear that require either a public IP or Teredo. 90.204.215.80 (talk) 17:36, 4 December 2010 (UTC)

 * I think it was invented/discussed in this post on the Firewalls Mailing List in 1992: http://www.greatcircle.com/firewalls/mhonarc/firewalls.199212/msg00089.html The terminology NAT does not appear (it didn't exist yet), but the implementation concept clearly discusses replacing address and port numbers with other addresses and ports rather than having multiple connections and a proxy process.

72.45.221.198

NAT as a firewall (as in NAT-router or NAT-modem)
Can there be more said about NAT in the context of consumer-grade (residential or SOHO) routers or broadband modems with built-in NAT functionality. Specifically, given that class of hardware, can it be said that the in-bound firewall effect of NAT is equivalent to (if not superior to) software firewalls running on a client machine (and again I'm comparing the in-bound firewall effectiveness of the NAT-router or NAT-modem vs the inbound direction of the software firewall).

Many people seem to think that NAT makes a poor in-bound firewall compared to a sofware firewall. Are they right? What is the argument for or against such a belief?

 * NAT proper is mostly security by obscurity. Adding inbound rate limiting against brute force attacks, and doing stateful firewalling add greatly to the protection. As it is, I write my own firewall rules, and I still use host-level firewalling, and have backups and such on a physically separate house network separated from the Internet gateway. Howard C. Berkowitz 03:54, 3 July 2007 (UTC)

"NAT proper is mostly security by obscurity". While that may be a cute phrase, technically that isin't correct. NAT works by keeping a table of out-bound and in-bound packets (ie - port assignments) and simply drops incoming packets that don't have a matching out-bound table entry that was assigned by the router itself.

 * "Security by obscurity" is a very serious phrase that describes a lot of user behavior that really doesn't provide much security.

 * Strictly speaking, you are describing a special case of NATP (network and port translation). There can be legitimate cases where there is no clean match from an outside source/port to an inbound address/port, due to issues such as redirection (e.g., in HTTP or FTP). This sort of thing needs a true application layer gateway or highly intelligent stateful proxy, not just NAT, to determine if traffic is legitimate. Howard C. Berkowitz 19:01, 14 July 2007 (UTC)

I guess my question boils down to, say, the difference between NAT as a firewall vs Stateful Packet Inspection from a security point of view. Or, what is the difference between a NAT router vs a software firewall when we are considering in-bound malicious activity.

 * This depends, in part, of your definition of a firewall. To me, a firewall is often a proxy, and at least stateful, in examining inbound traffic. Every environment has to be evaluated. Is it plausible that a hostile individual can hijack TCP sessions and exploit the known sessions. Stateless NAT is pretty limited as a security tool. I'd rather not see much security discussion in that article, with the security part being in a firewall article. Howard C. Berkowitz 19:01, 14 July 2007 (UTC)

Ok, let me ask this. The main article defines "Symetric NAT" under "Different types of NAT". I believe that it should also call it "one to many" in the same way that "Full Cone NAT" is AKA "one to one". Given symetric NAT (one to many), are external unsolicted in-bound packets (both UDP and TCP) blocked or dropped, or just TCP?

Can it be said that a "symetric NAT-router" blocks or drops all external in-bound unsolicited packets, regardless of the type of packet?

And can it also be said that a typical home or SOHO NAT-router is a "symetric NAT-router" ?

When it comes to unsolicited in-bound connection attempts, does a software firewall application have any capabilities to provide extra "protection" that is not performed by a SOHO NAT-router?

When it comes to SOLICITED in-bound connection attempts, must a software firewall application employ Stateful Packet Inspection in order to provide some level of security or monitoring of those packets - and how many firewall programs perform this inspection?

(I am trying to get an answer as to what redeeming utility a software firewall has when it comes to in-bound connections or in-bound data monitoring that isin't already performed by a NAT-router. That is why this section is called "NAT as a firewall").

NAT behavior article needed
Folks, we need a NAT behavior article describing (at least) the endpoint mapping and endpoint filtering characteristics. Other stuff that is included in RFC 4787 would be nice, diagrams illustrating the behavior would definitely be a plus. The RFC is all about UDP, but the same properties apply for TCP and others also. --Siipikarja 19:13, 29 August 2007 (UTC)

 * How about we start with a NAT behavior section. I'll add it to the todo list. --Kvng (talk) 19:16, 14 March 2011 (UTC)

NAT vs PAT
Trying to keep this brief - 2 main strands: 1. NAT and PAT are very different. I guess no disagreement there. Secondly while most people talk about NAT they usually mean PAT. Again I guess we agree here. The DIFFERENCE comes in that I think we should state that just calling PAT, NAT is incorrect. I want this stated clearly hence my edit. 2. Though possibly overlooked, I also tried, very briefly and I accept probably inadequately, to show that there are a number of different types of NAT. The two most common are static NAT and 'pooled' NAT. I hope this is non-contentious, though I accept I've not made this very clear but then in an introductory section I didn't think a detailed discussion was required. I hope this makes clear what I am trying to achieve. Mercury543210 19:43, 1 October 2007 (UTC)

 * PAT is indeed the predominant technique, if for no other reason than the need to recompute TCP and UDP checksums. True NAT, however, can apply to IP-only things such as ICMP. Howard C. Berkowitz 19:54, 1 October 2007 (UTC)
 * Where did this term PAT come from in the first place? It seems the RFCs use basic nat to reffer to things that only translate IPs, NAPT to things that translate both and NAT as a general term covering both. I think we can take the terminology the RFCs use as authoritive. Plugwash 23:03, 1 October 2007 (UTC)

 * I do remember, at some IETF meetings, someone trying to say NAPT, and the appropriate protocol response seemed to be Gesundheit! Howard C. Berkowitz 00:32, 2 October 2007 (UTC)
 * Hmm I have no problems saying it........... Plugwash 13:22, 2 October 2007 (UTC)

A quick google for 'NAPT firewall', throws up about 281k hits, 'PAT firewall' returns over 1.7 million hits. Since an encyclopaedia should be accessible, can I suggest that we stick with the more common term PAT and not RFC 3022's NAPT? Mercury543210 20:08, 2 October 2007 (UTC)
 * PAT vs NAPT
 * Neither term is common
 * PAT is misleading (devices that change the port number almost invariablly change the IP address as well)
 * NAPT is what the RFCs use
 * Looking at your google results it seems that PAT is a term mostly used by cisco and its community and isn't in widespread use outside of that.
 * Afaict the terms PAT and NAPT appear together once in the article (there is also a see also to a seperate PAT article but that should probablly be merged here it mostly duplicates information from this article anyway). I don't see any pressing need to use them elsewhere in the article.
 * Afaict the terms PAT and NAPT appear together once in the article (there is also a see also to a seperate PAT article but that should probablly be merged here it mostly duplicates information from this article anyway). I don't see any pressing need to use them elsewhere in the article.

 * Your point is? An encyclopaedia is about accessibility, if the majority use PAT then that is the term most people, if not techies, will come across and we should use it. You could then inform them that the official term is NAPT but it's not one they would have come across. Also this seems an odd argument as currently the section title does not use NAPT anyway, so what are you saying?
 * PS please sign your comments. Mercury543210 16:48, 3 October 2007 (UTC)
 * My point is I don't think there is any need to push either of the terms neither of which is in common use. Plugwash 16:52, 3 October 2007 (UTC)
 * I agree NAPT is not 'in common use' - that is the point I'm making. It is also quite clear that PAT is 'in common use'. Hence my concern that we are following a line which excludes non-specialists from finding and learning. I still think we should use common terms, even if they're disliked (why?) by some. Mercury543210 18:40, 4 October 2007 (UTC)
 * As an informative article, whether it's in common use or not should be moot. By not clarifying which one, it can generate confusion as to which one is correct.  I think the emphasis of the section, however, should be the behavior of the protocol; controversy over it's name is probably another article altogether.  Perhaps simply explaining the correct term NAPT according to RFC 3022 (with linked reference of course,) but it is commonly called PAT for reasons lost to obscurity would sufficient address both Mercury543210 and Plugwash's concerns? Undisputedloser (talk) 16:55, 6 December 2007 (UTC)
 * "I agree NAPT is not 'in common use' - that is the point I'm making. It is also quite clear that PAT is 'in common use'."
 * Lets see, a google search for "pat nat" (without quotes. searching for pat alone would obviously bring a huge false positive rate). gets me "about 330,000" results. Searching for "napt nat" gives "about 255,000" results. By comparison searching for "nat network" gives "about 3,270,000". So it seems to me that the term PAT is a bit more common than NAPT but neither is in common use. Also of the NAT PAT results on the first page a significant proportion seem to be cisco related suggesting that this term is something of a ciscoism.
 * As I said before I don't see any pressing need to use either of theese relatively uncommon acronyms elsewhere in the article. It only takes a word or two to clarify on the few points where there may be confusion. Plugwash (talk) 01:40, 26 June 2008 (UTC)

Inappropriate argument about IPv6's making NATs useless
''It has been argued that the wide adoption of IPv6 would make NAT useless, as the latter is a method of handling the shortage of IPv4 address space. However, this argument either ignores the natural firewall provided by NAT, or assumes that consumer-grade network routing devices (which are often installed by purchasers lacking knowledge of firewall configuration) would always be factory configured to block incoming server requests.''

Why would anyone want this type of "firewall"? This is exactly what is wrong with NATs. If a computer doesn't want to accept an incomeing server request *it shouldn't be listing on that port*! A computer accepts these requests voluntarily, unless a virus has infected the computer in the first place. I'm going to trim this paragraph to not imply that this is a good thing. Fresheneesz (talk) 06:26, 21 November 2007 (UTC)

You might be mistaken here - it is a rather simple firewall functionality - still - a host would be exposed to any kind of DOS attack from the outside without even a simple NAT mechanism that prevents such connections. Maybe the inside host is listening to connections from other inside hosts? (Yes there are client firewalls - so why buy ASAs, Checkpoints or Netscreens anyway?) I disagree with your trimming - so it is a 'good thing' in my opinion .. CiscoKid-728 4th December 2007 —Preceding comment was added at 19:14, 4 December 2007 (UTC)

NAT is NOT what provides the security in this case, and, a stateful IPv6 firewall can easily have a default deny policy for incoming sessions without the breakage caused by NAT. NAT is unnecessary except for address shortages, or, extraordinary circumstances such as a desire/need to present a network as an artificially different prefix. The breakage caused by NAT vastly exceeds its usefulness for most of the IPv6 world, and, the claims of security have been repeatedly proven to be mythical. —Preceding unsigned comment added by Owendelong (talk • contribs) 18:59, 11 September 2009 (UTC)

Hello —Preceding unsigned comment added by 86.147.121.74 (talk) 20:03, 15 February 2008 (UTC)

PAT popularly, but incorrectly, called simply "NAT"
"PAT (Port Address Translation) - The type popularly, but incorrectly, called simply "NAT""

I thought I knew what NAT was, then I came to this page. Ok, so according to the article, PAT is the mechanism by which multiple machines share a single IP address. All the home routers I've ever used have called it NAT. But why is it incorrect for PAT to be called NAT? The article states that there are two kinds of NAT: PAT and Basic NAT. Therefore PAT should come under the umbrella term of NAT. Secondly the article itself uses NAT to mean PAT:

"NAT first became popular as a way to deal with the IPv4 address shortage"

This clearly refers to PAT because with Basic NAT there is a 1:1 correspondence between external IP addresses and internal IP addresses, and that doesn't give you any extra addresses at all. Egriffin (talk) 12:12, 25 February 2008 (UTC)

 * I have just removed the "but incorrectly". If someone wants to call it incorrect they had better provide a damn good cite for what you consider correct terminology. The RFCs I have seen use the term "Basic NAT" for nats that only translate IP addresses, "NAPT" for ones that translate both. They use the term NAT as a general term covering both. They do not use the term PAT at all. Plugwash (talk) 01:29, 26 June 2008 (UTC)
 * From a quick google test I get the impression that PAT may be a cisco-ism but i'm not sure. Plugwash (talk) 01:29, 26 June 2008 (UTC)

further expansion of a seemingly unrelated statement?
I'm left to only guess at the meaning of the following statement:

It is also a problem with Xbox Live gameplay when the need for players to communicate becomes harder and slows down gameplay.

Particularly, how does it relate to NAT? Are NAT issues what cause the slowdown? Do they hinder communication? Or does scaling the number of players upwards prove difficult due to NAT issues? But at face value, the statement seems to have little to do with NAT.

Would the author of the statement please expound further? Thanks.

--Paul (talk) 19:13, 25 June 2008 (UTC)

Self-referencing See-Alsos
Maybe it's my wikipedia-n00bdom, but I don't see much point in a see-also that goes to a redirect page that comes back to the NAT page, even if it does try to send you right to the appropriate anchor. Should those see-alsos just be removed? Kraigus (talk) 15:10, 11 September 2009 (UTC)
 * This often happens and goes unnoticed when articles get merged. Sometimes it's used as a placeholder when someone intends to write a new article from a section (but that often doesn't happen later). So, yes, in general they should be removed. Kbrose (talk) 15:58, 11 September 2009 (UTC)

"Security" changes
I disagree with the changes to the tone and substance of the article that were introduced by Seikku Kaita's recent edits.

To whit:

 * Changing "is" to "has been" is not a language cleanup; it changes the meaning of the entire sentence.

 * Is the number really "millions and millions"? Please cite. Even so, it seems the "and millions" part is hyperbole.

 * Is it really "most of Europe"? Please cite. Same for the "Russia, Asia" part.

 * Are only ADSL routers effective in protecting network assets? How about cable routers? SDSL routers? My (really ancient) Cisco 2600? Let's not qualify unless it's necessary and beneficial.

 * More to the point, Information Security professionals will tell you that, while NAT/PAT may be a part of an effective program to secure an intranet and obscure its topology from prying eyes, it really doesn't protect customers from direct attack.

 * Some people will not do business with an ISP that provides a simulated Internet connection through NAT/PAT and proxy devices, because it breaks so many things. While some messengers and Skype may work properly within such a walled garden, they do so because they are designed to. We should not be championing provisioning schemes that violate the word and spirit of the RFC-defined open Internet.

— UncleBubba ( T @ C ) 13:25, 29 September 2010 (UTC)

 * Some people will not do business with an ISP that provides a simulated Internet connection through NAT/PAT... In most cases there will be no choice (ok, no choice for reasonable price). I am not aware of any mobile internet provider, which would not use NAT (in some cases there is available non NATtted internet access, but it usually costs ~10x more for same usage). I do not know about satellite internet, but it is more costly anyway. -Yyy (talk) 16:07, 24 November 2010 (UTC)

 * IME you can get a VPN link to give you a public unfiltered static (or dynamic) IPv4 address for around a third the cost of a mobile connection. So if someone is trying to sell you 10x they're trying to screw you. 90.204.215.252 (talk) 09:08, 29 January 2011 (UTC)

A Replacement Section -- What is NAT
I'll just leave this here for now, if you have more time before I do please consider moving it into the main article.

NAT is Network address translation.

It is used to convert the addresses and port numbers on internet packets between zones. Normally the zones are 'Internal' and 'Public' though others are possible.

This mainly applies TCP/IP and UDP/IP, IPv6 does not have a general need for address translation and other IP protocols don't have a well defined method of providing anything other then plain NAT. The exception being ICMP where the packets can usually be related to an existing TCP or UDP connection and so translated as part of that connection.

An IP packet has four values that can be used for normal NAT processing, these are converted between Internal and Public by the NAT router. They are the Source Address ( SAI and SAP ), the Source Port ( SPI and SPP ), the Destination Address ( DAI and DAP ) and Destination Port ( DPI and DPP )

When a packet arrives from an internal host bound for the public internet the router has the four Internal values SAI, SPI, DAI, DPI on the packet. The values DAI and DPI say where the packet has to go and must be copied unchanged to fields DAP and DPP on the public packet. The value SAI is a private IP address and MUST be changed because it's not allowed on the internet. The SPI (port) value may be changed if required. In addition the router must remember the change that it's made so that it can reverse this change when the inevitable reply to the packet arrives.

If the router has only one public IP address there's no choice; SAP must be set to this address, if the router has multiple public addresses it gets to choose which one to put on the packet. If it has enough public IP addresses it can do 'Plain NAT' and have a direct mapping between the internal host IP address and a public address. But normally it has to share the available ports on one (or very few) public IPs between the internal hosts.

When the reply arrives it has the four values SAP, SPP, DAP, DPP. Because the packet is going in the opposite direction the machines that 'source' and 'destination' refer to are reversed related to the original outgoing packet, but it's the same four values that router translated the packet to when it sent the original request out.

This means the initial translation is:

SAI, SPI, DAI, DPI ==> SAP, SPP, DAP, DPP

Applying the rules on what changes are needed we get

SAI, SPI, DA, DP ==> Router-IPn, SPP, DA, DP

So for the reply the router needs a table where it can find SAI and SPI given any or all of the four public values.

For Plain NAT it assumes SPI and SPP are identical and indexes a table of internal IP addresses based on Router-IPn.

The other named forms of NAT assume the is just one Router-IP so ignoring that...

For Full-cone NAT the index is SPP one public port maps to one internal port. This variant is sometimes labelled PAT.

For Address restricted cone NAT the index is SPP + DA, the port can be shared between internal hosts but not if they're talking to the same remote.

For Port-restricted cone NAT the index is SPP + DA + DP, this can allow even more sharing; unless everyone wants to talk http to Google.

For all three of these forms the router usually tries to reuse the same mapping if a new connection arrives from either side that matches the parameters. Also two mappings will share Router-IPn and SPP if the connections have the same SAI and SPI even when DA and DP are different. But these rules don't apply to Symmetric NAT, for this the router limits who can connect based on the same sort of rule as Port-restricted cone NAT but instead of trying to make SPI and SPP identical it actively ensures that each mapping uses a different SPP. (Perhaps even a random SPP)

However, this distinction is a bit misleading, because a router doing Port-restricted cone NAT will act like one running Symmetric NAT if it's under a load where multiple internal hosts are trying to use the same SPP (eg 1025) to communicate with well known remote servers on well known ports (Google via http again). This means that to do the two 'restricted' named versions of NAT the router must actually be doing full cone NAT but afterwards only accepting returning packets from the original remote host (&port) to be predictable in the way they're supposed to be.

What's more some NAT routers will record all the information required for a Port-restricted cone NAT but use a 'best match' process for packets that don't match exactly. This gives the effect of switching cones when there's a collision between mappings.

Some Operating systems distinguish between 'Source NAT' (SNAT) and 'Destination NAT' (DNAT) this distinction is related to how the NAT mapping is setup not how it works. Nevertheless, this can mean that the router will use different cones depending on which is used.

90.204.215.80 (talk) 16:48, 4 December 2010 (UTC)

Cleaning up
This article is a mess, the same thing is said several times in different ways. I've tried to make a start on cleaning it up but there is still much that needs doing. In particular:

 * The article is mostly about one type of NAT (one to many nat) which while reasonable given that it is by far the most common type needs to be clearer.
 * the "implementation" section is mostly repeating stuff that has already been said in slightly more detail. IMO we should probablly try and merge any relavent detail into the previous descriptions and then get rid of it.
 * The analogy subsection of the implementation subsection is a TERRIBLE analogy, most NAT setups don't have a "receptionist" who can direct traffic to any internal machine, nor would their admins want one.
 * the "advantages of PAT" section is a couple of sentances stating the obvious.
 * the SNAT situation seems to be mostly a terminology definition, maybe it should be replaced with a more general terminology subsection explaining the terms used with NAT and any ambiguities that may occour.
 * the "secure NAT" subsection of the SNAT section states the obvious interpretation of the term "secure nat" but doesn't say what is actually meant when a vendor says a "NAT" is secure
 * This sentence is confusing: "The more common [More common than what??] arrangement is having computers that require end-to-end connectivity supplied with a routable IP address, while having others that do not provide services to outside users behind NAT with only a few IP addresses used to enable Internet access."  I propose: "A common arrangement is to have computers that require end-to-end connectivity supplied with a routable IP address, while computers that do not provide services to outside users are behind NAT. Such an arrangement rations routable IP addresses."  ThinkerFeeler (talk) 04:40, 6 October 2016 (UTC)

Any comments and anyone else want to take a stab at cleaning things up? Plugwash (talk) 08:49, 4 March 2011 (UTC)

 * Looks reasonable to me. Repetition is partly due to merges. I've taken the liberty of creating a WP:TODO list. --Kvng (talk) 15:13, 6 March 2011 (UTC)

2.2 An Analogy - Pet peeve and question
"The analogy subsection of the implementation subsection is a TERRIBLE analogy, most NAT setups don't have a "receptionist" who can direct traffic to any internal machine, nor would their admins want one."

Actually that's a *GOOD* analogy for the following reason: Typically if a user connects out through a NAT to the "real world" InterNet, where all local users share a single IP (i.e. there's no 1-1 mapping between local IPs and public IPs, just *all* local IPs map to a single public IP), and requests a "call back", there's no way the "real world" host can do that "call back", because there's no way the "real world" host can guess how to address through that single public IP to the correct local IP.

MY PET PEEVE: Almost exactly the same problem occurs when I get a telephone call from a company that has only one public telephone number, mapping all private internal-outgoing lines to that one public telephone number, which shows up on my caller-ID unit. When I get back home, I see the caller-ID, so I try to call the person back, but I get the switchboard operator instead of the person who called me. I ask the operator to tell me who called me. I have the exact time (accurate to the minute). Surely the company automatically keeps track of which internal phone line makes a call to which external number at such-and-such minute, right? No. Kaiser Permanente has no way to track down whether it was my primary care physician, or the lab, or the emergencey room, or the IT staff, or any number of other likely suspects, or even a harassing telemarketing call (despite the fact I'm on the do-not-call list, which doesn't stop telemarketers). So I have to spend an hour calling the advice nurce and the IT department and ten other places at Kaiser Permanente asking whether each of them called me, and then wait several days to get letters in the mail telling me whether each called me or not. If it was something urgent, such as they discovered a cancer which requires immediate surgery, or they are calling me to tell me they've scheduled an appointment for me later the same day or the next day, I have no way to know until it's too late. So-far, this has happened several times, and there was not one case where I *ever* found out who really had called me. So maybe somebody could amend the metaphor to show how it really is not so bad a metaphor after all, that 1-to-many NAT precludes call-backs, analagously on Internet or telephone.

So anyway my question is: Does anybody have a workaround to somehow make it possible to do a call-back? For example, even though a single IP is used, there are lots of ports that could be used. So could somebody wanting a call-back tell the NAT to please reserve port foo on the single-IP to map to port bar on *my* local/private IP, for some specified period of time, then I tell the remote host to call me back *not* on port bar of the single-IP but rather port foo of the single-IP. 198.144.192.45 (talk) 09:33, 9 March 2011 (UTC) Twitter.Com/CalRobert (Robert Maas)

 * Please see WP:FORUM. I don't see how your question relates to development of the article. You might try Reference_desk/Computing. --Kvng (talk) 14:49, 11 March 2011 (UTC)

Bad analogy. In the real world, desktop phone extensions are static and map to specific people or departments. It has been a long time since I have seen lots of static IP addresses on a network, usually the desktops are DHCP, besides which, if you did find the source, it would likely be a non-routable address of which there will be thousands of duplications, if not millions across the world. I'm not sure that NAT was designed to be primarily a basic form of security, but it is a great simple one, that is for sure mostly because it anonymises the 'caller'. To my knowledge, practically, it is very hard to determine if an address is a NAT gateway device, there are good clues, but not normally can anyone ascertain that any one device's address represents many thousands or the device is, for example, not a terminal service or proxy server. Also, the limitations of NAT devices are around memory and processor capability and since the device, usually a routing device of some sort, has finite resources, the session IDs are reused over and over. Only the device can tell you and only if it maintains a log, so you will need access to the device and like your broadband router at home, the deivce will be physically restricted to the management interface being accessible from the internal side only and if not, then by very rare and usually careless exception. You can see how NAT works at a practical level by using something VMware (two hosts and a virtual routner) and protocol analyser like SNORT or, to a lesser degree, NMAP. Thanks, Gund. — Preceding unsigned comment added by 116.199.214.34 (talk) 02:15, 30 May 2012 (UTC)

 * I think Robert's analogy is a good analogy. To answer Robert's question: Yes, there are workarounds to make it possible to do a call-back. Typically they all require servers with a globally-reachable IP address.

 * (1) The simplest case: hosts behind a NAT router send messages to servers with a globally-reachable IP address. This network address translation article *should* explain how the NAT router initially creates and *remembers* a mapping between internal IP-address/port-number pair to external IP-address/port-number that (hopefully) lasts long enough for the entire conversation between the host and the server.
 * (2) 2 hosts behind two *different* NAT routers want to communicate. They both send all their messsages to the same intermediate globally-reachable server, which forwards the data in the message similar to the way a NAT router forwards packets.
 * (3) 2 hosts behind two *different* NAT routers want to communicate. They initially send a few messsages to some intermediate globally-reachable server, which replies with what it's figured out about the NAT router configuration of the *other* host. The hole punching (networking) (such as UDP hole punching and TCP hole punching) articles *should* explain how the hosts can then directly communicate to each other, with no more help from the globally-reachable server.
 * How can we make *this* article better, to more clearly explain (or at least link to other articles that explain) how to work-around the difficulties in communication caused by NAT ? --DavidCary (talk) 15:11, 27 February 2020 (UTC)

"PAT" is an oxymoron
An address is an address and a port is a port. One does not translate or convert between them. Port Forwarding differs.

"PAT" doesn't exist in IETF specs that deal with address translation. Terms used in them are Source NAT (SNAT) and Destination NAT (DNAT). The "many-to-one" and "one-to-many" concepts aren't self-explanatory but neither is an oxymoron. Given that a single network may wish to connect with many others, a router that does NATing refers to the "one" in each instance. Networks that allow source NATing are prone to the simplest of Denial of Service attacks so most commercial ISPs drop Source NATed packets. Destination NAT is what allows a router to use the private IP address space (for more than one client).

Regarding the first sentence, consider an address is analogous to a high-rise building and each unit in that building as analogous to a port. Now consider two such high-rise buildings, A and B. If someone in building A sends a letter to someone in building B, they need to specify a unit number in building B, to receive the letter. The inverse is also true.

If a router translates a single IP address to any given port, 65,534 ports won't be able to receive connection requests. This doesn't seem reasonable. — Preceding unsigned comment added by 97.122.82.150 (talk) 06:39, 5 February 2012 (UTC)

Source IP address in UDP and TCP ?
Gosh I'm looking at the packet formats for UDP and TCP and there are no source IP address fields. Source port yes, but not sourt IP address. "the source address in each packet is translated" and "the source address in each packet is translated"  "mapped to a unique external source IP address"  .. at worse this article is just plain wrong, or at best it is very confusing. I think some major edits are needed. See http://www.inetdaemon.com/tutorials/internet/udp/index.shtml for a udp packet diagram, and http://www.techrepublic.com/article/exploring-the-anatomy-of-a-data-packet/1041907 for a tcp packet diagram. No source IP address fields. — Preceding unsigned comment added by 216.19.190.96 (talk) 18:58, 18 July 2012 (UTC)

 * The IP addresses are stored in the IP packet header http://www.inetdaemon.com/tutorials/internet/ip/datagram_structure.shtml If you're sending UDP packets across an ethernet each one contains an ethernet packet with and ethernet header which contains an IP packet with and IP header which contains the UDP packet with the UDP header which contains the user data. 2001:470:1F09:10D6:215:FF:FE77:FD85 (talk) 09:32, 26 August 2012 (UTC)

 * I agree this is confusing, so I tried to clarify. Whenever this article mentions a "packet", it almost always refers to an IP packet with an IP header that includes the source IP address and the destination IP address. In practice the vast majority of IP packets contain either a UDP packet or a TCP packet, either one of which includes the source port and the destination port. How can we make this article less confusing? --DavidCary (talk) 04:49, 8 March 2020 (UTC)

a collection of weapons and military equipment stored by a country, person, or group.
Sure "arsenal" has a whatever-ary alternate definition of "an array of resources available for a certain purpose", but seriously folks, come on... who keeps "tool"s in their "arsenal"? I keep guns, bombs, germs, and chemicals in my arsenal. I keep tools in my toolbox. — Preceding unsigned comment added by 73.206.82.214 (talk) 19:48, 27 May 2015 (UTC)

External links modified (February 2018)
Hello fellow Wikipedians,

I have just modified one external link on Network address translation. Please take a moment to review my edit. If you have any questions, or need the bot to ignore the links, or the page altogether, please visit this simple FaQ for additional information. I made the following changes:
 * Added archive https://web.archive.org/web/20100724011252/http://illuminati.coralcdn.org/stats/ to http://illuminati.coralcdn.org/stats/

When you have finished reviewing my changes, you may follow the instructions on the template below to fix any issues with the URLs.

Cheers.— InternetArchiveBot  (Report bug) 12:05, 16 February 2018 (UTC)

Typo in SVG
The graphic misspells the word "destination" as "destenation".

 * That has already been pointed out at . I have left the contributor a message. ~Kvng (talk) 14:41, 27 August 2020 (UTC)

IPv6 NAT in Enterprise Products
Hello, I'm revising the IPv6 part because it a lot of products (to the point that even OpenWRT included it) have a true one-to-many NAT66 function. I've cited https://blogs.infoblox.com/ipv6-coe/you-thought-there-was-no-nat-for-ipv6-but-nat-still-exists/ for it but it seems that thinks that's not an appropriate resource even though the article itself didn't have an upsell (I believe Infoblox doesn't even sell routers). Should I instead link the manuals individually? That seems to be too primary source to me to be honest, but it seems that general media doesn't cover enterprise IP products. Thanks. - 2001:4453:581:9400:C044:83DF:67DC:4E3 (talk) 16:52, 4 May 2022 (UTC)

 * See WP:RS. We don't use self published marketing materials such as vendor blogs as sources. If no one outside of vendor blogs and product manuals are covering this, it may be that this is a feature no one really cares about and isn't fit for mention in the encyclopedia. - MrOllie (talk) 17:12, 4 May 2022 (UTC)
 * I do think that an exception under the second point of Identifying and using self-published works (the writer is an expert in the networking field and has published articles in NetworkWorld that is related to his work https://www.networkworld.com/author/scott-hogg/), and that a better source hasn't been found despite exhaustive searches. An alternative is linking up to the primary sources individually, although primary sources isn't really preferred. I'm just really disappointed that the article states that IPv6 NAT don't exist when it has been implemented in multiple independent products. - 2001:4453:581:9400:C044:83DF:67DC:4E3 (talk) 17:31, 4 May 2022 (UTC)
 * It does not say that IPv6 NAT does not exist, it says it 'is not commonly used' which is true. MrOllie (talk) 17:35, 4 May 2022 (UTC)
 * I do think that the wording is deficient though, while it is uncommon in a home setting it is used in enterprise settings. I've instead resorted to linking to primary sources instead. - 2001:4453:581:9400:C044:83DF:67DC:4E3 (talk) 17:50, 4 May 2022 (UTC)
 * Do you have a source that says it is commonly used in enterprise settings? A few product manuals do not establish this. Many vendors produce 'solutions in search of a problem'. Even the infoblox blog says 'NAT is not needed or recommended.' MrOllie (talk) 17:51, 4 May 2022 (UTC)

Hairpinning
Is there a reason to have a separate article on this? ~Kvng (talk) 02:06, 25 May 2022 (UTC)

 * Good catch. The article is largely redundant with the section Network_address_translation and that section is better written and with better context. A redirect and possible merge of anything not covered in the section looks like the best course to me. -- 20:31, 25 May 2022 (UTC)

Symmetric NAT in "Methods of translation" implies no internal port is used
The previous three rows in the "Methods of translation" section table use iAddr:iPort variables to explain how they work. The Symmetric NAT row does not use these variables. Additionally, it does not otherwise refer to an internal port being used to generate the mapping/translation. I'm under the impression that "symmetric" NATs use internal IP and port. Should the internal port be added? If so, I could edit it to use similar verbiage as the above rows, which would make the table more cohesive narratively.

I haven't actually worked with NATs before so might be wrong here, so thought a discussion topic was best instead of an immediate edit. Aegatlin (talk) 22:52, 27 February 2023 (UTC)

title: Talk:Network address translation


text:
José Cotto

José Miguel Cotto Vázquez (born June 22, 1977) is a Puerto Rican professional boxer and a four-time regional level champion. He is the brother of six-time world boxing champion Miguel Cotto and the cousin of lightweight contender Abner Cotto.

Amateur career
In 1995, as an amateur, he participated at the Pan American Games in Mar del Plata, Argentina, and won a silver medal. A year later, he represented his native country at the 1996 Summer Olympics, where he was defeated in the first round.

Pro career
He won the WBC Youth World super bantamweight title on August 20, 2000, a split decision win against a capable young Fernando Velardez (who would later fight Mexican legend Erik Morales for Morales' WBC Featherweight title).

On July 25, 2003, Cotto was supposed to fight in Phoenix, Arizona. However, his opponent had trouble getting a license to fight, as he had been knocked out recently and was serving a 45-day suspension from another state. The Arizona boxing commission was unable to find Cotto an opponent in time, and the fight got cancelled.

On September 9, at his native Caguas, Cotto finally returned to action, with a first-round knockout win over Johnny Walker. On December 19, he fought Anthony Martinez in Aibonito, winning by an eighth-round knockout.

Cotto moved to Phoenix early in 2004. On April 14 of that year, he stopped Mexican Luis Lizarraga at two minutes and thirty-seven seconds of the first round to win the regional, International Boxing Council (IBC) Intercontinental super featherweight title. He has also won the vacant WBO intercontinental super featherweight title during his fight with Genaro Trazancos.

On August 6, he beat former WBA Bantamweight champion Al Kotey by a ten-round unanimous decision in San Juan. On August 20, 2005, Cotto would have boxed Manuel Medina, with a world title shot at stake. But he was unable to make the fight's weight limit and the fight was cancelled.

On January 29, 2005, Cotto knocked out Armando Cordoba in the first round to win the vacant WBO NABO lightweight title.

On January 20, 2006, Cotto knocked Ubaldo Hernandez out in seven rounds at Mayfield, California. On April 8, he received his first world title try, losing a twelve-round decision to Juan Díaz as part of a Pay Per View undercard, for the WBA world Lightweight title in an exciting fight where both contestants threw nearly a hundred punches per round.

In May 2007, he and Prawat Singwangcha (30-3-1, 18 KOs) battled to a twelve-round draw in a bout for the vacant WBA lightweight title.

Cotto then proceeded to fight Canelo Álvarez at welterweight. Cotto got off to a good start and almost knocked out Alvarez, in round 2, Cotto went down after missing a hook. The referee stopped the fight in round 9 after Cotto was trapped in the corner and was taking many flush right hands by Alvarez.

On April 9, 2011, he lost a 10-round unanimous decision to former IBF Light Welterweight champion Paulie Malignaggi, managing to buckle Maligaggi a couple of times.

He was scheduled to face former two time lightweight champion José Luis Castillo on February 11, 2012, though it was cancelled due to Castillo coming in overweight. On April 21, 2012, Jose Cotto beat Eric Cruz (13-8 13 KO's) by UD over 10 rounds, knocking the overmatched opponent down twice.

Professional boxing record (incomplete)

 * align="center" colspan=8|33 Wins (24 knockouts), 4 loss(s), 1 Draw, 0 No Contest
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Res.
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Record
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Opponent
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Type
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Rd., Time
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Date
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Location
 * align=center style="border-style: none none solid solid; background: #e3e3e3"|Notes
 * -align=center
 * Loss||33-4-1||align=left| 🇺🇸 Manuel Pérez
 * SD||10||2012-07-21
 * align=left|🇲🇽 Oasis Hotel Complex, Cancún, Quintana Roo
 * align=left|For NABA Lightweight title.
 * -align=center
 * Win||33-3-1||align=left| 🇵🇷 Eric Cruz
 * UD||10||2012-04-21
 * align=left|🇵🇷 Coliseo Roger L. Mendoza, Caguas
 * align=left|
 * -align=center
 * Loss||32-3-1||align=left| 🇺🇸 Paulie Malignaggi
 * UD||10||2011-04-09
 * align=left|🇺🇸 MGM Grand Garden Arena, Las Vegas
 * align=left|
 * -align=center
 * Win||32-2-1||align=left| 🇧🇧 Christopher Henry
 * TKO||4 (10), 1:19||2010-11-05
 * align=left|🇵🇷 Coliseo Cosme Beitia Salamo, Cataño
 * align=left|
 * -align=center
 * Loss||31-2-1||align=left| 🇲🇽 Canelo Álvarez
 * TKO||9 (10), 2:51||2010-05-01
 * align=left|🇺🇸 MGM Grand Garden Arena, Las Vegas
 * align=left|For NABF WBA Latino Super-Light Welterweight title.
 * -align=center
 * Win||31-1-1||align=left| 🇨🇴 Ilido Julio
 * TKO||6 (8)||2009-12-19
 * align=left|🇵🇷 Coliseo Roger L. Mendoza, Caguas
 * align=left|
 * -align=center
 * Win||30-1-1||align=left| 🇺🇸 Martin Ramirez
 * KO||3 (8), 2:52||2009-09-26
 * align=left|🇵🇷 Coliseo Héctor Solá Bezares, Caguas
 * align=left|
 * -align=center
 * Win||29-1-1||align=left| 🇧🇸 Anthony Woods
 * TKO||4 (8), 2:24||2009-08-29
 * align=left|🇵🇷 Coliseo Ruben Viera, Las Piedras
 * align=left|
 * -align=center
 * style="background:#abcdef;"|Draw||28-1-1||align=left| 🇹🇭 Prawet Singwancha
 * MD||12||2007-05-11
 * align=left|🇵🇷 Coliseo Angel 'Cholo' Espada, Salinas
 * align=left|For vacant WBA World Lightweight title.
 * -align=center
 * Win||28-1-0||align=left| 🇨🇴 Ivan Hernandez
 * TKO||10 (10), 1:57||2006-08-04
 * align=left|🇵🇷 Coliseo Pedrín Zorrilla, Hato Rey
 * align=left|
 * -align=center
 * Loss||27-1-0||align=left| 🇺🇸 Juan Díaz
 * UD||12||2006-04-08
 * align=left|🇺🇸 Thomas & Mack Center, Las Vegas
 * align=left|For WBA World Lightweight title.
 * -align=center
 * Win||26-0-0||align=left| 🇲🇽 Ubaldo Hernandez
 * KO||7 (10), 2:59||2006-01-20
 * align=left|🇺🇸 Activity Center, Maywood, California
 * align=left|
 * -align=center
 * Win||25-0-0||align=left| 🇲🇽 Genaro Trazancos
 * TKO||7 (12), 1:00||2005-03-04
 * align=left|🇵🇷 Coliseo Pedrín Zorrilla, Hato Rey
 * align=left|Won vacant WBO Inter-Continental Super Featherweight title.
 * -align=center
 * Win||24-0-0||align=left| 🇵🇦 Armando Cordoba
 * KO||1 (12), 1:27||2005-01-29
 * align=left|🇵🇷 Coliseo Rubén Rodríguez, Hato Rey
 * align=left|Won vacant WBO NABO Lightweight title.
 * -align=center
 * Win||23-0-0||align=left| 🇬🇭 Alfred Kotey
 * UD||10||2004-08-06
 * align=left|🇵🇷 Coliseo Pedrín Zorrilla, Hato Rey
 * align=left|
 * -align=center
 * Win||22-0-0||align=left| 🇲🇽 Luis Alfonso Lizarraga
 * KO||1 (11), 2:27||2004-05-14
 * align=left|🇺🇸 Dodge Theater, Phoenix, Arizona
 * align=left|Won IBC Intercontinental Lightweight title.
 * align=left|🇺🇸 Dodge Theater, Phoenix, Arizona
 * align=left|Won IBC Intercontinental Lightweight title.

title: José Cotto