Core Networking · Study deck

Port Numbers and NAT for IoT

Picture a home air sensor that can send readings to its service but cannot accept a new incoming connection from the public side.

Packet Pete is your guide for this deck.

addrports

After studying this chapter

Learning objectives

You will be able to:

Explain: Diagnosis needs a name for the thing you are tracing. the The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path diagram shows the five values that name one MQTT session.
Explain: Together they identify one conversation, which is why a firewall rule or a capture filter written from all five is precise, and one written from an address alone is not.
Explain: The last note explains why that is survivable: an MQTT client usually holds the connection open, so the translation entry stays alive and replies keep finding their way home.
identify services with transport port numbers

The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path.

Major section

Start With the Doorway into the Service

The owner sees one public address on the router and assumes every device behind it can be reached.

The missing fact is which conversation opened the temporary return doorway.
A protocol means agreed rules for exchanging messages.
IPv4 is one common address system.
A gateway is the device that carries traffic between networks.

Major section

Start With the Doorway into the Service (continued)

Network address translation means rewriting a private address and often its service number at that boundary.

Telemetry is a device’s reported measurements and state, carried through this address and port path.
Transmission Control Protocol (TCP) keeps an ordered connection; User Datagram Protocol (UDP) sends separate messages.
Hypertext Transfer Protocol Secure (HTTPS), Message Queuing Telemetry Transport (MQTT), and Constrained Application Protocol (CoAP) are named service rules that may use those transports.

A translation table is state. It must be created, kept alive long enough, and diagnosed when traffic stops.

Major section

Overview: Ports Identify Services, NAT Rewrites Conversations

Diagnosis needs a name for the thing you are tracing. Figure: The five-tuple identifies one network conversation shows the five values that name one MQTT session.

NAT rewrites the first two on the public side, so the same conversation has two valid descriptions depending on where you stand.
Diagnosis needs a name for the thing you are tracing. the The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path diagram shows the five values that name one MQTT session.

Major section

Overview: Ports Identify Services, NAT Rewrites Conversations (continued)

The sensor opens the conversation from a private address and a high port, 192.168.1.50:49152, and sends an MQTT over TLS request.

Together they identify one conversation, which is why a firewall rule or a capture filter written from all five is precise, and one written from an address alone is not.
At the NAT router that pair is rewritten.
Diagnosis needs a name for the thing you are tracing. the The five-tuple identifies one network conversation. NAT can rewrite the public-side source address and port while preserving a return path diagram shows the five values that name one MQTT session.

Major section

Overview: Ports Identify Services, NAT Rewrites Conversations (continued)

The last note explains why that is survivable: an MQTT client usually holds the connection open, so the translation entry stays alive and replies keep finding their way home.

The last arrow in Figure: NAT records the private-side conversation and exposes a is the part to remember.
Nothing outside can start this conversation, and the design has to live with that boundary.
The router in the middle gives all three the same public address and separates them by handing out a different public port to each.
This connects the port diagnosis to a design that avoids exposing a general inbound service.

NAT records the private-side conversation and exposes a translated public-side conversation to the internet.

Major section

Keep One MQTT Reply Attached to One Socket

The router can map 10.0.0.21:49152 to public port 61001 and 10.0.0.22:49152 to public port 61002.

When an idle mapping expires, an unsolicited late reply has no private destination to recover.
Inbound port forwarding is a separate NAT rule.
The private source ports may match because the full five-tuples do not.
Exposing an IoT service this way also needs firewall and authentication decisions.

Major section

Keep One MQTT Reply Attached to One Socket (continued)

Even if both outward flows use public port 61002 at different times, destination address, destination port, protocol, and session timing still distinguish their NAT state.

A capture that records only the public source port is incomplete.
If a router drops MQTT state after 60 seconds and the sensor stays silent for 90 seconds, the next broker packet may meet no NAT mapping.
A 45-second keep-alive may preserve the path, but only a test on that router can confirm its timeout and battery cost.

Persistent outbound MQTT connection through NAT to a cloud broker

Major section

Summary

NAT rewrites private-side address and port information into public-side mappings so many IoT devices can share one IPv4 address.

That translation is useful, but it changes how cloud-to-device communication, diagnostics, and remote management must be designed.

Deck summary

Key takeaways

The owner sees one public address on the router and assumes every device behind it can be reached.

Network address translation means rewriting a private address and often its service number at that boundary.
Diagnosis needs a name for the thing you are tracing. Figure: The five-tuple identifies one network conversation shows the five values that name one MQTT session.
The sensor opens the conversation from a private address and a high port, 192.168.1.50:49152, and sends an MQTT over TLS request.
NAT rewrites private-side address and port information into public-side mappings so many IoT devices can share one IPv4 address.

Retrieval practice

Recall check 1 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q1What does a port number add to an IP address in an IoT connection?

AIt replaces the need for a source and destination IP address.

BIt proves that a device is reachable from the public internet.

CIt tells a router which Wi-Fi channel the device should use.

DIt identifies the service conversation on the host.

Show answer

Answer: D A port number identifies the service or conversation on a host.

Retrieval practice

Recall check 2 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q2A cellular IoT sensor is behind carrier NAT, and an operator wants to connect to it directly from the internet. What is the core problem?

ACellular networks cannot carry TCP connections from devices.

BAll sensor telemetry requires a publicly routable IPv4 address.

CIoT traffic cannot use the requested destination port number.

DCarrier NAT lacks an inbound mapping for the operator's connection.

Show answer

Answer: D NAT normally creates return paths for outbound-initiated conversations.

Retrieval practice

Recall check 3 of 3

Packet Pete says: answer from memory, then check your reasoning.

Q3Which diagnostic record best explains a failed cloud-to-device command for a device behind NAT?

AA private-IP note because local addressing proves that the command can reach the device through the gateway.

BA port number alone because an open service port establishes the command route and application response.

CPort, policy, NAT state, and the attempted command path together.

DDisable NAT for the sensors because direct addressing removes the gateway mapping failure.

Show answer

Answer: C Port and NAT troubleshooting should produce a boundary-specific record, not a guess.

Print reference

Answers

Answer key.

D · A port number identifies the service or conversation on a host.
D · NAT normally creates return paths for outbound-initiated conversations.
C · Port and NAT troubleshooting should produce a boundary-specific record, not a guess.