One Public IP, Many Devices

1Two kinds of IP address

Your home actually has two layers of IP addresses.

Private addresses start with 192.168 or 10, among others. Millions of homes use exactly the same private addresses — your neighbour’s phone may also be 192.168.0.102. That is fine, because a private address never leaves the home. It is also why a whole home needs only one public address, which matters because IPv4 does not have enough addresses to give one to every device in the world.

2Port numbers: which conversation is which

When several devices use the Internet at the same time, every reply comes back to the same public address. The router needs a way to tell them apart. It uses a port number: a number written next to the IP address, after a colon, like 203.0.113.45:51001. Think of it as a flat number in a building, or a ticket number at a counter. The IP address finds the building; the port finds the right door.

The port next to a private IP address

Ports are not only used by the router. Your phone uses them too. Look at 192.168.0.102:50312 again: it has two parts, and each answers a different question.

A phone runs many apps at once, and several of them may be using the Internet at the same moment. The IP address brings data to the right device; the port brings it to the right app on that device.

• When the YouTube app opens a connection, the phone gives that connection a temporary port, say 50312, and remembers that it belongs to the YouTube app.
• If you also open YouTube in the Chrome browser, Chrome’s connection gets a different port, say 50313. Replies to 50312 go to the YouTube app, and replies to 50313 go to Chrome, even though both come from YouTube to the same phone.
• These ports are temporary. The next time the app connects, it may get a different number. One app can even have several ports at once, one for each connection.
• The website’s side is different: a website waits for visitors on a fixed, well-known port. For secure web pages that is port 443, the same on every website.

So a port appears twice in this story. Next to the private IP address, it tells the phone which app a reply is for. Next to the public IP address, it tells the router which device a reply is for. The NAT table links the two.

3The YouTube story, step by step

Your phone, at 192.168.0.102, wants a YouTube video. With 📱 Phone and ▶️ YouTube chosen, press ▶ Play the story and follow the packet, or press 👣 Step by step and move one step at a time with Next step ▶ and ◀ Back. Watch the label on the packet change at the router, and watch the two tables under the picture.

On the way out

1. The phone sends its request. The packet says it is from 192.168.0.102:50312: the phone’s private address, and a port the phone picked for this conversation.
2. The router stops the packet and replaces the private address with its own public address, and the port with a new one it chooses: 203.0.113.45:51001.
3. It writes this down in its NAT table:
   192.168.0.102:50312 ⟷ 203.0.113.45:51001 (YouTube)
4. The request crosses the Internet. YouTube sees only 203.0.113.45:51001; it never learns the phone’s private address.

On the way back

5. YouTube sends the video to 203.0.113.45:51001.
6. The router reads the port, 51001, and looks it up in the NAT table: “port 51001 belongs to 192.168.0.102:50312”. It puts the phone’s private address back on the packet.
7. The router now knows which IP address the video is for. To hand it over inside the home network, it needs that device’s MAC address — see the next section.
8. The video reaches the phone.

4The last step: the router’s IP-to-MAC table

Inside a network, data is handed to a device by its MAC address — the same way a switch does it. So the router keeps a second table, which lists every device connected at home with its private IP address and its MAC address. This table is needed on the way back.

After the NAT table has given the router 192.168.0.102, it looks that up here, finds 3C:22:FB:7A:10:04, and sends the video to the device with that MAC address. The router fills this table by itself as devices on the network talk to it; its proper name is the ARP table.

This is the IP address and MAC address working together, just as the last lesson said: the IP address gets the data to the right home and tells the router which device it is for; the MAC address delivers it to that device.

5NAT and PAT

Swapping addresses at the router is called NAT, Network Address Translation. The kind every home router uses, which also swaps port numbers so that many devices can share one public address, is called PAT, Port Address Translation. Most people just call it NAT.

Some internet companies, especially mobile networks, do the same trick a second time on their side: many homes share one public address, and the company’s own equipment keeps the table.

6A message nobody asked for

Press 🕵️ A message nobody asked for in the lab. It arrives at a port that has no row in the NAT table, so the router has no idea which device it is for, and drops it. This is a useful side effect of NAT: a device at home cannot be reached from the Internet unless it started the conversation.

7Check yourself