What does NAT do to the address a service sees?¶
title: "What does NAT do to the address a service sees?" card_id: "IP-053" status: "complete" source_document: "https://docs.google.com/document/d/1KxGXNaa69u01D6LBbmWxppzL9CYfixdsZFrBslJD0bw/edit?usp=drivesdk"
What does NAT do to the address a service sees?¶
Private IP addresses are used inside local networks, while public IP addresses are used on the internet. So how do devices using private addresses communicate with the outside world? They commonly use Network Address Translation, or NAT.
Imagine a home with a laptop, two phones and a games console. Each device can have its own private IP address inside the home network. Those private addresses aren’t routed across the public internet. The router uses a public IP address when the devices communicate with online services.
When the laptop makes a connection, the router changes the source details before sending the traffic onwards. It records a mapping so that, when the reply comes back, it can direct that reply to the right device. Ports usually help the router keep simultaneous connections separate.
The online service normally sees the public IP address used after translation, not the laptop’s private address. If several devices use the same router, their activity may therefore appear to come from the same public IP address.
The same principle can operate at a larger scale. An internet provider may place many customers behind carrier-grade NAT. In that case, unrelated households or mobile devices can share one public address at the same time. The translated source port, protocol and precise timestamp may be needed to distinguish them.
NAT doesn’t prove that the public IP address belongs permanently to one device, and it doesn’t identify the person who carried out the activity. It tells you that the service saw traffic after it had passed through a translation point.
If you need to trace the connection back, preserve what the service actually recorded: the public source IP address, translated source port where available, protocol, exact timestamp and time zone. Those details can be compared with the translating provider’s logs. On a private network, router, firewall, DHCP or Wi-Fi records may then be needed to link the connection to an internal address or device.
Keep each step separate in your conclusion. The service saw a public address. NAT may have mapped that connection from a private device or another customer connection. Further records may narrow the route, but the visible public address alone doesn’t establish which device or person was responsible.