DHCP and NAT: How a Host Gets an Address, and How Many Hosts Share One

The picture: a hotel desk and a switchboard#

You arrive at a hotel. You do not bring your own room number. The front desk lends you one, plus a key card that stops working on the day you check out. They also tell you where breakfast is and which number to call for help. That is DHCP, the Dynamic Host Configuration Protocol: a network lends a newcomer an address for a set time, and tells it the other things it needs.

Now picture an office with one public phone number. Callers dial that number and a receptionist connects them to the right extension. When staff call out, the person they ring sees only the main number. That is NAT, network address translation: a whole network shares one public address, and a box at the edge keeps track of which inside machine each conversation belongs to.

Vocabulary, before anything uses it#

DHCP in four messages#

A new host does not know the DHCP server’s address, or even its own. So it broadcasts to 255.255.255.255, reaching everyone on its subnet. The client listens on UDP port 68 and the server on UDP port 67.

Remember the order as DORA. The transaction ID tells a client which replies are its own, since every host hears every broadcast.

Why is the request still sent from 0.0.0.0 to everyone? The host does not own the address until the ACK. And if several servers made offers, the broadcast tells the others to take theirs back.

Routers do not forward 255.255.255.255. If the server is on another subnet, a relay agent on the client’s subnet passes the messages on.

What DHCP hands out, and how leases renew#

An address alone is not enough to use the Internet. The ACK also carries these settings, each as a DHCP option:

• Subnet mask, so the host knows which addresses are on its own subnet.
• Default gateway, the router to send everything else to.
• DNS server (Domain Name System), so the host can turn names into addresses.
• Lease time, how long the address is on loan.

A host does not wait for its lease to run out. RFC 2131 suggests it asks the same server to renew at time T1, half the lease, and asks any server at time T2, seven-eighths of the lease. Servers may set other values.

Where the address blocks come from#

DHCP hands out addresses from a block. So where does the block come from? Each level gets a slice of the level above it.

1. IANA, the Internet Assigned Numbers Authority, run under ICANN (the Internet Corporation for Assigned Names and Numbers), holds the whole address space.
2. It gives large blocks to five regional Internet registries, one for each part of the world. North America’s is ARIN, the American Registry for Internet Numbers.
3. The registries give blocks to ISPs and large organizations.
4. An ISP gives a smaller slice to each customer, which assigns addresses to its own interfaces, often with DHCP.

Since every customer block sits inside the ISP’s block, one route to 161.45.64.0/18 reaches them all. That is route aggregation, worked through in the guide on longest prefix matching and route aggregation.

NAT: one public address for a whole network#

IPv4 has only about 4.3 billion addresses, and IANA handed out its last free blocks in 2011. NAT stretches them. Inside the network, hosts use private addresses from three ranges set aside by RFC 1918:

Thousands of networks reuse these addresses, so the public Internet never routes them. The NAT router has a private address inside and one public address outside. To the outside world, the whole network looks like one device.

The translation table

The router keeps a NAT translation table. Each row pairs an outside (address, port) with an inside (address, port). The outside is often labeled the WAN side (wide area network) and the inside the LAN side (local area network).

• Going out, it replaces the source address and source port with its public address and a new port, and adds a row.
• Coming back, it looks up the destination port, and replaces the destination address and port with the inside ones from that row.

Both changes alter the headers, so the router also recomputes the IP header checksum and the TCP or UDP checksum.

How many conversations can one public address hold? The port field is 16 bits, so there are 2¹⁶ = 65,536 ports. Leaving out the 1,024 well-known ports (0 to 1023) leaves 64,512, which is where the usual “over 60,000 simultaneous connections per public address” figure comes from. Real NATs stretch it by reusing ports across destinations.

Why NAT is controversial#

NAT is everywhere, but draws three objections.

• It breaks layering. A router is a network-layer device, but NAT reads and changes port numbers, which belong to the transport layer.
• It breaks the end-to-end idea. Hosts were meant to reach each other directly. Behind NAT, an outside host cannot start a conversation with an inside one, because no table row exists until the inside host sends first.
• Servers need workarounds. To run a server inside, an administrator sets up port forwarding: a fixed row such as “outside port 8443 always goes to 10.0.0.20 port 443”. Peer-to-peer apps need NAT traversal tricks, such as a relay server.

The long-term answer is IPv6 (Internet Protocol version 6), whose address space is big enough that every device can have a public address. NAT was meant as a stopgap.

Practice#

For the DHCP questions, draw the four arrows first. For the NAT questions, draw the table first.

1. A laptop sends a DHCP discover. Give its source IP address, destination IP address, source UDP port and destination UDP port.
2. By the time it sends a DHCP request, the laptop has been offered an address. Why is the request still sent from 0.0.0.0 to 255.255.255.255?
3. A DHCP server grants a lease of 2 hours and the client uses the RFC 2131 suggested timers. When does the client first try to renew with its own server, and when does it start asking any server?
4. Which of these are RFC 1918 private addresses? 172.15.0.1, 172.31.200.4, 10.255.0.9, 192.169.0.1.
5. Using the studio’s NAT table above, a third laptop, 10.0.0.13, sends from port 49152 to 192.0.2.25 port 80, and the router picks outside port 40003. Write the datagram’s source and destination as it leaves the router, and the reply as it arrives and as it is delivered inside.
6. A datagram arrives at 203.0.113.9 port 40777, and the table has no row for 40777. What does the router do, and why?
7. Roughly how many simultaneous connections can one public IPv4 address support through NAT? Show where the number comes from.

Solutions#

1. Source 0.0.0.0 port 68; destination 255.255.255.255 port 67. The laptop has no address yet and does not know the server’s, so it broadcasts. Clients use port 68 and servers port 67.
2. The laptop does not own the address until the ACK arrives, and other servers must hear the choice. More than one server may have offered an address; the broadcast request tells them all which offer was accepted, so the others can release theirs.
3. T1 = 60 minutes; T2 = 105 minutes. The lease is 7,200 s. T1 = 0.5 × 7,200 = 3,600 s = 60 min. T2 = 0.875 × 7,200 = 6,300 s = 105 min.
4. 172.31.200.4 and 10.255.0.9. 172.16.0.0/12 runs from 172.16.0.0 to 172.31.255.255, so 172.15.0.1 is outside it. 10.0.0.0/8 covers all of 10.x.x.x. 192.169.0.1 is outside 192.168.0.0/16.
5. Leaving: 203.0.113.9:40003 → 192.0.2.25:80. Reply arriving: 192.0.2.25:80 → 203.0.113.9:40003. Delivered inside: 192.0.2.25:80 → 10.0.0.13:49152. The router adds the row (203.0.113.9, 40003) ↔ (10.0.0.13, 49152) and uses it in reverse for the reply.
6. It drops the datagram (unless a port-forwarding rule covers port 40777). With no row, it has no idea which inside host the datagram is for. This is also why outside hosts cannot start conversations with hosts behind NAT.
7. About 60,000. The port field is 16 bits: 2¹⁶ = 65,536 ports. Leaving out the 1,024 well-known ports gives 64,512. In the simple model, each active connection needs its own outside port on that address.

Test-readiness checklist#

• ☐  I can list the four DHCP messages in order, with source and destination address and port for each.
• ☐  I can explain why DHCP uses 0.0.0.0 and 255.255.255.255, and what the transaction ID is for.
• ☐  I can name four things DHCP hands out, and compute the renewal times for a given lease.
• ☐  I can trace an address block from IANA to a regional registry to an ISP to an organization.
• ☐  I can list the three RFC 1918 private ranges and say whether an address is in one.
• ☐  I can push a datagram through a NAT table in both directions, rewriting addresses and ports.
• ☐  I can explain the 60,000-connection limit and the three main objections to NAT.

Frequently asked questions#

Something here not clear? A topic you wish we covered? Tell us. We read every message, and a request is the fastest way to get a guide written.