PAT

Overview

The form of NAT almost everyone actually uses is PAT (Port Address Translation) — many devices sharing a single public address, distinguished by port numbers. It is what makes one home or office IP serve dozens of devices at once. This lesson explains PAT and how it differs from basic NAT.

Learning objectives

• Define PAT (also called NAT overload).
• Explain how ports disambiguate shared connections.
• Distinguish PAT from one-to-one NAT.

Core concept

PAT, also called NAT overload or many-to-one NAT, maps many private addresses to a single public address, using port numbers to keep the connections apart. Basic NAT might map addresses one-to-one; PAT overloads one public address for many internal hosts by also translating the source port, so each connection remains uniquely identifiable.

This is the mechanism behind virtually every home and small-office router.

How it works

For each outbound connection, the PAT device rewrites the source to its public IP and assigns a unique source port, recording the full mapping (internal IP:port ↔ public IP:port) in its table. When a reply arrives at the public IP on that port, the device looks up the mapping and delivers it to the correct internal host and port. Because the combination of public IP and port is unique per connection, one public address can support a very large number of simultaneous connections.

Practical example

Two devices browse at once through one public IP 203.0.113.5:

• Laptop 192.168.1.50:51000 → translated to 203.0.113.5:40001
• Phone 192.168.1.51:52000 → translated to 203.0.113.5:40002

Both replies come back to 203.0.113.5 but on different ports (40001 vs 40002), so the router routes each to the right device. The single public address serves both simultaneously, disambiguated entirely by port.

Cybersecurity relevance

PAT means many users can appear behind one public IP, which complicates attribution: a single external address may represent an entire network of devices, something analysts must remember when interpreting logs (you cannot assume one IP = one user). It also means inbound connections cannot reach a specific internal device without explicit port forwarding. Understanding PAT is essential for correctly reading traffic sources and planning reachability in testing.

Common mistakes

• Assuming one public IP equals one device/user — PAT hides many behind one address.
• Confusing PAT with one-to-one NAT — PAT overloads a single address using ports.
• Expecting inbound access without port forwarding to a PAT'd internal host.

Key takeaways

• PAT (NAT overload) maps many private hosts to one public address, using unique port numbers to keep connections separate.
• The device tracks internal IP:port ↔ public IP:port mappings so replies reach the right host.
• PAT is the standard for home/office routers; it complicates attribution (one IP = many devices) and requires port forwarding for inbound access.

Check your understanding

• How does PAT let a single public IP address serve many devices at the same time?
• Why can't you assume that one public IP address in a log corresponds to a single device or user?