NAT Operation
B-10
Since there is no NAT entry record that will match the address values in this
packet (specifically port 20 in the From field), this packet will not be forwarded
to the FTP client. In order for this to work, there must be a port mapping
installed for 64.1.1.100 that has a wildcard port value (we can’t be sure that
the connection request will arrive on port 20). The NAT entry table would be
as follows:
NAT Entry Table
Foreign IP
Foreign
Port
Local IP
Local
Port
Mapped
Port
IP Protocol
TCP State
Timeout
64.1.1.100
wild
192.168.0.32
1137
50003
TCP
–
STATIC
64.1.1.100
21
192.168.0.32
1137
50003
TCP
CONNECT
04:58:39
With such a mapping, if a connection request from port 20 arrived, the wild card
entry would be matched, and another entry spawned for port 20 on IH. The
table would look as follows:
NAT Entry Table
Foreign IP
Foreign
Port
Local IP
Local
Port
Mapped
Port
IP Protocol
TCP State
Timeout
64.1.1.100
20
192.168.0.32
1137
50003
TCP
SYNSENT
00:01:00
64.1.1.100
wild
192.168.0.32
1137
50003
TCP
–
STATIC
64.1.1.100
21
192.168.0.32
1137
50003
TCP
CONNECT
04:58:39
The second issue in dealing with an FTP client is that the client can change
the port on which the FTP server attempts connection. This is done via a PORT
command sent from the client to the server. The PORT command contains in-
formation about the client in the packet payload.
For example, assume the FTP client (H1) creates a new socket for the data
connection, and its ephemeral port value is 1142. H1 would then send an FTP
PORT command on the control connection to the server. The server would
then attempt a connection. The following is an approximation of the operation
(it is not the exact syntax of the port command).
Packet 3 (FTP Client H1 Sends Port Command for Port 1142)
To
From
Protocol
Packet Payload
64.1.1.100 : 21
192.168.0.32 : 1137
TCP
“PORT 192.168.0.32, 1142”