0

To try to find the inside local address of a host, on a LAN with 1 Cisco wireless router, I run nping on one Windows7 host 192.168.1.138. 

C:\>nping --ec "public" -c 1 echo.nmap.org

SENT (1.4430s) ICMP 192.168.1.138 > 74.207.244.221 Echo request (type=8/code=0) ttl=64 id=53719 iplen=28
CAPT (1.5520s) ICMP 216.164.56.243 > 74.207.244.221 Echo request (type=8/code=0) ttl=55 id=53719 iplen=28
RCVD (1.6320s) ICMP 74.207.244.221 > 192.168.1.138 Echo reply (type=0/code=0) ttl=54 id=10848 iplen=28

The output shows the inside local IP source is 192.168.1.138/24 which after NAT has changed (see CAPT line) to an inside global IP of 216.164.56.243. At nearly the same time I run nping on the same LAN and on a different Windows 7 host with the inside local 192.168.144/24, yet the CAPT line still shows the same inside global IP of 216.164.56.243. If the inside global IPs of the two hosts are the same, then it would appear that the router is using either dynamic NAT with a NAT pool, or dynamic NAT with overloading (PAT). From just the packet analysis from the host machines, and not requiring access to the router CLI or CCP, how do you tell which type of NAT configuration the router is using?

T. Webster
  • 346
  • 3
  • 9
  • 20

1 Answers1

1

You should also try some port numbers in there to see how those are mapped, it is probably a cone style NAT, but you need to see which of the three style they are:

  1. Full cone, any external device can send traffic to your internal address, they will just need to know the external port number. This is usually called one to one mapping, you might see it used to expose an internal web server's ports to the world.
  2. Address restricted cone, the external server can reply to an internal host if it has received a packet from the internal machine first, the server can reply from any port, the only restriction is that only that server can reply.
  3. Port restricted cone, the external server can reply to the internal machine on a specific port, and from a specific port (the same port the server was contacted on).

It is obviously one of the last two options, which one will require further testing to see which port numbers are used.. if you have access to the external server, see if can send replies from any port, or only the port it replied on.

I don't think it's dynamic NAT, or you would see multiple external addresses.

NickW
  • 10,263
  • 1
  • 20
  • 27
  • This might have been a bad question, but thx for the response. I should have added that the *different* Windows 7 host was in fact a virtual machine host running on the same machine, with a different *virtual* network interface. On a real network with real hosts, it seems impossible to determine the exact NAT translation used by the router at the boundary between the network and the internet from just the Windows7 host alone, without having *some* means to either access the router configuration or the outbound packets. – T. Webster Apr 10 '13 at 04:39
  • Yeah, router access makes everything easier :) – NickW Apr 10 '13 at 08:26