Core Networking · Study deck

Port Numbers and NAT for IoT

Picture a home air sensor that can send readings to its service but cannot accept a new incoming connection from the public side.

Packet Pete is your guide for this deck.

addrports
Packet Pete, the module guide, in a scene from this chapter.
iotclass.org

After studying this chapter

Learning objectives

You will be able to:

  • Explain: The visual's third anchor,: Source port, completes the five-tuple identifies one network conversation. Nat can rewrite the public-side source address and port while preserving a return path.
  • Explain: Even if both outward flows use public port 61002 at different times, destination address, destination port, protocol, and session timing still distinguish their NAT state.
  • Explain: Carry: TCP/IP 5-Tuple for an MQTT Connection into overview: ports identify services, nat rewrites conversations; use: Source port as its limiting condition.
  • Explain: Transmission Control Protocol (TCP) keeps an ordered connection; User Datagram Protocol (UDP) sends separate messages.
iotclass.org

Major section

Start With the Doorway into the Service

The owner sees one public address on the router and assumes every device behind it can be reached.

  • The missing fact is which conversation opened the temporary return doorway.
  • A protocol means agreed rules for exchanging messages.
  • IPv4 is one common address system.
  • A gateway is the device that carries traffic between networks.

Key terms

Network address translation
Network address translation means rewriting a private address and often its service number at that boundary.
Telemetry
Telemetry means readings and status sent by a remote device.
iotclass.org

Major section

Start With the Doorway into the Service (continued)

Network address translation means rewriting a private address and often its service number at that boundary.

  • Telemetry means readings and status sent by a remote device.
  • Transmission Control Protocol (TCP) keeps an ordered connection; User Datagram Protocol (UDP) sends separate messages.
  • This trace does not prove every router, firewall, or mobile network.
iotclass.org

Major section

Overview: Ports Identify Services, NAT Rewrites Conversations

The visual's third anchor,: Source port, completes the five-tuple identifies one network conversation. Nat can rewrite the public-side source address and port while preserving a return path.

  • Carry: TCP/IP 5-Tuple for an MQTT Connection into overview: ports identify services, nat rewrites conversations; use: Source port as its limiting condition.
The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path.
The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path.
iotclass.org

Major section

Overview: Ports Identify Services, NAT Rewrites Conversations (continued)

Broker messages return over that established flow while the gateway continues to reject unrelated inbound attempts.

  • That visual pairing grounds nat records the private-side conversation and exposes a translated public-side conversation to the internet in named evidence.
  • The next claim about practitioner: design around the nat boundary depends on Figure: A translation table is state.
  • This connects the port diagnosis to a design that avoids exposing a general inbound service.
iotclass.org

Major section

Keep One MQTT Reply Attached to One Socket

The router can map 10.0.0.21:49152 to public port 61001 and 10.0.0.22:49152 to public port 61002.

  • When an idle mapping expires, an unsolicited late reply has no private destination to recover.
  • Inbound port forwarding is a separate NAT rule.

Why it matters

The private source ports may match because the full five-tuples do not.

The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path.
The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path.
iotclass.org

Major section

Keep One MQTT Reply Attached to One Socket (continued)

Exposing an IoT service this way also needs firewall and authentication decisions.

  • Even if both outward flows use public port 61002 at different times, destination address, destination port, protocol, and session timing still distinguish their NAT state.
  • A capture that records only the public source port is incomplete.
  • A 45-second keep-alive may preserve the path, but only a test on that router can confirm its timeout and battery cost.
iotclass.org

Deck summary

Key takeaways

The owner sees one public address on the router and assumes every device behind it can be reached.

  • Network address translation means rewriting a private address and often its service number at that boundary.
  • The visual's third anchor,: Source port, completes the five-tuple identifies one network conversation. Nat can rewrite the public-side source address and port while preserving a return path.
  • Broker messages return over that established flow while the gateway continues to reject unrelated inbound attempts.
  • The router can map 10.0.0.21:49152 to public port 61001 and 10.0.0.22:49152 to public port 61002.
iotclass.org

Retrieval practice

Recall check 1 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q1What does a port number add to an IP address in an IoT connection?

AIt identifies the service conversation on the host.
BIt replaces the need for a source and destination IP address.
CIt proves that a device is reachable from the public internet.
DIt tells a router which Wi-Fi channel the device should use.
Show answer

Answer: A A port number identifies the service or conversation on a host.

iotclass.org

Retrieval practice

Recall check 2 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q2A cellular IoT sensor is behind carrier NAT, and an operator wants to connect to it directly from the internet. What is the core problem?

AThe NAT has no existing inbound mapping for the operator's connection
BTCP cannot be used on cellular IoT networks.
CThe device must use a public IPv4 address for all telemetry.
DThe destination port is too high for IoT traffic.
Show answer

Answer: A NAT normally creates return paths for outbound-initiated conversations.

iotclass.org

Retrieval practice

Recall check 3 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q3Which diagnostic record best explains a failed cloud-to-device command for a device behind NAT?

AA note saying the device has a private IP address, so no further diagnosis is possible.
BA port number alone, because it proves both routing and application correctness.
CA record of port, policy, NAT state, and command path.
DA decision to disable NAT so every sensor can receive unsolicited inbound traffic.
Show answer

Answer: C Port and NAT troubleshooting should produce a boundary-specific record, not a guess.

iotclass.org

Print reference

Answers

Answer key.

  1. A · A port number identifies the service or conversation on a host.
  2. A · NAT normally creates return paths for outbound-initiated conversations.
  3. C · Port and NAT troubleshooting should produce a boundary-specific record, not a guess.
iotclass.org