CGNAT: what breaks when a thousand subscribers share one address

Carrier-grade NAT (CGN) is a NAT in the provider's network that shares one public IPv4 address among many subscribers, with the shared address space 100.64.0.0/10 numbering the link behind it. After reading, you can state what RFC 6888 requires of a CGN, name what the published tests found broken, explain why an address alone no longer identifies a subscriber, compute the log volume and a deterministic port block, place NAT444 among DS-Lite and the A+P designs, and check whether your own connection sits behind one.

View as Markdown

(RFC) 6888 defines -grade (CGN, often written ) as a NAT-based function that shares one IPv4 address among several subscribers, and adds: "A CGN is not managed by the subscribers" (RFC 6888, section 2). The name describes a place, not a quality: "the term 'carrier-grade' has nothing to do with the quality of the NAT" (section 2). You meet it when your router's wide area network () address starts with 100.64, when two homes cannot play one game together, or when an address and a time no longer name a person. After reading, you can say what RFC 6888 requires, name what broke in tests, list what an answerable attribution request carries, compute log volumes and a port block, compare NAT444 with its alternatives, and check your own connection.

Two layers of NAT and the space between them

Each subscriber gets a private address, a NAT in the Internet service provider's ('s) network translates it, and a second NAT at the customer edge makes two layers (RFC 6888, section 1). The inner layer is the home router doing what NAT explained describes; the outer one is the CGN, "also called NAT444 CGN or Large Scale NAT" (RFC 6264, section 1).

The link between the CGN and the customer premises equipment () needs addresses of its own: "The Shared Address Space address range is 100.64.0.0/10" (RFC 6598, section 7), 4,194,304 addresses from 100.64.0.0 to 100.127.255.255. It is distinct from RFC 1918 private space, which is unsafe there when "subscribers provide their own CPE and number their own internal network" (section 3). Shared addresses must not cross provider boundaries or appear in external DNS (sections 4 and 6), and the Internet Assigned Numbers Authority () marks the block not globally reachable (IANA, IPv4 Special-Purpose Address Registry), the column the ranges article explains.

Why the addresses ran out

The central pool emptied in 2011, and the regional Internet registries (RIRs) followed on their own dates:

Registry	Event	Date
Number Resource Organization (NRO), for the central pool	free pool "now fully depleted" (NRO)	3 February 2011
Asia Pacific Network Information Centre (APNIC)	final /8 policy in effect (APNIC)	15 April 2011
Latin American and Caribbean Internet Address Registry ()	one /10 left (NRO); last block reserved (LACNIC)	10 June 2014; 28 August 2020
American Registry for Internet Numbers (ARIN)	final free-pool addresses issued (ARIN)	24 September 2015
RIPE Network Coordination Centre (RIPE NCC)	last /8 in 2012; run out (RIPE NCC)	25 November 2019
African Network Information Centre (AFRINIC)	exhaustion phase 2, still current when read (AFRINIC)	since 13 January 2020

The RIPE NCC set the transfer market and CGNAT side by side and judged that "neither one solves the underlying problem, which is that there are not enough IPv4 addresses for everyone" (RIPE NCC, 25 November 2019). The full history is in How IPv4 addresses work.

What RFC 6888 requires of a carrier-grade NAT

RFC 6888 builds on the generic NAT documents: its REQ-1 makes a CGN meet the behavioural requirements of RFC 4787 for UDP and RFC 5382 for TCP (RFC 6888, section 3). Endpoint-independent mapping therefore comes from RFC 4787: "A NAT MUST have an 'Endpoint-Independent Mapping' behavior" (RFC 4787, section 4.1). What RFC 6888 adds is this:

Requirement	Strength	What it asks	Section
REQ-2	MUST	"Paired" address pooling: one external address for all of a subscriber's sessions (RFC 4787 only recommends it)	3
REQ-4	MUST	a configurable limit on external ports per subscriber, for fairness	3
REQ-7	RECOMMENDED	endpoint-independent filtering, which some games and applications need	3
REQ-8	SHOULD	no reuse of a released port for at least 120 seconds, also after a crash or failover	3
REQ-9	MUST	a protocol giving subscribers control over their mappings, preferably the Port Control Protocol (PCP)	3
REQ-11	MUST and SHOULD	at quota: drop the packet, send an Internet Control Message Protocol () Host Unreachable, never delete existing mappings	3
REQ-12	SHOULD NOT	log destination addresses or ports, because "Destination logging at the CGN creates privacy issues"	4
REQ-13 to REQ-15	SHOULD	maximise port use, minimise log volume, make ports hard to guess	5

The last three conflict: "A CGN implementation's choice of port allocation scheme optimizes to satisfy one requirement at the expense of another" (RFC 6888, section 5). Above the 1,024 system ports an address has 64,512, so a static split gives 1,008 ports each to 64 subscribers and 64 each to 1,000. A worm on one device could exhaust the shared address for everyone, which the REQ-4 limit prevents (RFC 6269, section 5.1).

What breaks for the subscriber

RFC 7021 reports tests of NAT444 in 2010 and of NAT444 and Dual-Stack Lite () in 2011 (RFC 7021, section 1). The baseline held: "basic services such as email and web browsing worked normally and as expected" (section 3). Peer-to-peer gaming failed between two homes behind one CGN, because both consoles tried the same port on one shared address (section 3.1). Session Initiation Protocol () calls without a proxy failed, BitTorrent seeding failed, and so did a File Transfer Protocol () server at home: "FTP sessions to servers located inside the home (e.g., behind two layers of NAT) failed" (section 3.1). In 2010 the IPv6 tunnels 6to4 and failed or degraded badly (section 3). Remote desktop, virtual private network (), ping and traceroute passed; a webcam failed (section 5.1). One console reported "Your NAT type is moderate", its own wording, not a term of the standards.

A remote desktop session started from home works; a server at home does not, since "inbound connections to well-known port numbers will not work in the general case" (RFC 6269, section 5.2.2), and a forwarded port must also be opened in the CGN (section 5.2.1). Neighbours pay too: "penalty box solutions to service abuse simply will not work" (section 13.1), blacklisting a spammer's address restricts everyone sharing it (section 13.3), and geolocation finds the CGN, not the home (section 7). A forged ICMP Packet Too Big can shrink the maximum transmission unit () a server caches for everyone on the address (section 10). RFC 6888 defends with port limits, ingress filtering against spoofed CPEs and hard-to-guess ports (RFC 6888, sections 3, 5 and 7).

Attribution: the address became a tuple

Once an address is shared, "the IPv4 address no longer uniquely identifies a subscriber" (RFC 6269, section 12). A request needs this: "The legal request should include the information: [Source IP address, Source Port, Timestamp]". Without the port at the server or destinations at the NAT, the provider "would need to disclose the identity of all subscribers who had active sessions on the NAT during the time period in question". Clocks must agree, since even small skew between a server and the CGN leaves doubt about who held a port; mappings are typically kept for 6 to 12 months, by jurisdiction (section 12).

The server's half is RFC 6302: log the source port and, in Coordinated Universal Time (), "A timestamp, RECOMMENDED in UTC, accurate to the second, from a traceable time source" (RFC 6302, section 2). With such servers the CGN need not log destinations (RFC 6888, section 4).

On 17 October 2017 Europol wrote that "it has become technically impossible for internet service providers to comply with legal orders to identify individual subscribers", which "may lead to innocent individuals being wrongly investigated by law enforcement" (Europol, 17 October 2017); the release counts CGN at 90% of mobile and 50% of fixed line, while its Internet Organised Crime Threat Assessment (IOCTA) 2017 gives 90% of mobile operators and 38% of fixed-line providers in 2016. The IOCTA recommends examining "source port number logging or limiting either the use of CGN or the number of subscribers behind each IPv4 address" (Europol, IOCTA 2017, pages 62 to 64).

In Brazil, article 13 of Lei 12.965/2014, the Marco Civil da Internet, says that "cabe ao administrador de sistema autônomo respectivo o dever de manter os registros de conexão, sob sigilo, em ambiente controlado e de segurança, pelo prazo de 1 (um) ano": the autonomous system's administrator keeps connection records, confidential and secured, for one year (Lei nº 12.965/2014, art. 13). Article 5, item VI, defines the record by "data e hora de início e término de uma conexão à internet, sua duração e o endereço IP utilizado pelo terminal": times, duration and IP address, with no source port. Release "deverá ser precedida de autorização judicial", needs a court's authorisation (article 13, paragraph 5).

The logging arithmetic

RFC 7422 measured log lines of about 150 bytes for NAT444 and 175 for DS-Lite, and reports about 33,000 connections per household per day (RFC 7422, section 1). Logging every connection then costs, recomputed:

Scope	Arithmetic	Result
one subscriber, one day	33,000 x 150 B	4.95 MB
one subscriber, 30 days	4.95 MB x 30	148.5 MB
one million subscribers, 30 days	148.5 MB x 1,000,000	148.5 TB
one million subscribers, one year	148.5 TB x 12	1.78 PB
log stream for 50,000 subscribers	50,000 x 4.95 MB x 8 / 86,400 s	22.9 Mbit/s
one DS-Lite subscriber, one day	33,000 x 175 B	5.775 MB

RFC 7422 rounds this to "approximately 150 terabytes of log data per month, or 1.8 petabytes per year" (section 1). Port blocks change the unit: "Logs are generated only when blocks are allocated or deallocated", which divides log generation by the block size (RFC 7768, section 2). For 20,000 subscribers over 60 days RFC 7768 reports 42.5 TB per session against 40.6 GB per block (section 1), 1,047 to 1. At 33,000 connections a day, 256-port blocks need at most 128.9 lines and 2,048-port blocks 16.1. The price is efficiency: a block is reserved whether or not its ports are used (RFC 9313, section 4.7).

Deterministic mapping: a function instead of a log

RFC 7422 makes the block a function of the inside address, with an inverse: "Internal IP Address = function 2 (External IP Address, Port Number)" (RFC 7422, section 2). The CGN removes reserved ports, divides the rest by the compression ratio C plus a dynamic pool factor D, and logs only overflow blocks. In the example of section 2.3, recomputed, 14 inside addresses share 192.0.2.1 with D = 2, so C + D = 16 and each gets (65,536 - 1,024) / 16 = 4,032 ports:

inside address    outside address and ports
198.51.100.1      192.0.2.1:1024-5055
198.51.100.2      192.0.2.1:5056-9087
198.51.100.14     192.0.2.1:53440-57471
dynamic pool      192.0.2.1:57472-65535   (8,064 ports = 2 x 4,032)

With a maximum of 5,040, each subscriber may take 1,008 overflow ports. A report of 192.0.2.1 port 2001 falls in 1024-5055: subscriber 1, found without CGN logs by matching the inside address with Dynamic Host Configuration Protocol () or Point-to-Point Protocol () lease records (section 2.3; see the DHCP lease lifecycle). Port 58204 lies in the dynamic pool, so the block log names subscriber 2, "assuming that the public safety timestamp matches the operator timestamp" (section 2.3). Changes to the variables must be recorded (section 3), and ports are chosen at random inside each range (section 5).

NAT444 against the alternatives

Every IPv4-as-a-service design translates statefully somewhere: "The major differentiator is where in the architecture this function is located" (RFC 9313, section 3.3). In the CGN-based family the provider holds per-session state. In the Address plus Port (A+P) family, which treats "some of the port number bits as part of an extended IPv4 address" (RFC 6346, abstract), the CPE translates its own home and the central function is stateless: Lightweight 4over6 (lw4o6) (RFC 7596, abstract), Mapping of Address and Port with Encapsulation (MAP-E) (RFC 7597, section 1) and MAP using Translation (MAP-T) (RFC 7599, section 1).

Design	Stateful NAT	IPv4 across the access network	What the provider keeps for attribution
NAT444	CGN in the provider	native IPv4	mappings or port blocks
DS-Lite	in the provider, at the tunnel end	tunnelled in IPv6	mappings or port blocks
464XLAT	in the provider	translated to IPv6	mappings or port blocks
lw4o6	in the CPE	tunnelled in IPv6	the binding table with timestamps
MAP-E	in the CPE	tunnelled in IPv6	the MAP rules with timestamps
MAP-T	in the CPE	translated to IPv6	the MAP rules with timestamps

The A+P price is that "the number of ports provided to each user (and hence the effective IPv4 address-sharing ratio) must be pre-provisioned to the client" (RFC 9313, section 4.2); stateful designs use ports better, and per-session logs may need a central translator (section 4.7). In MAP, a 6-bit Port Set ID (PSID) after the default 6-bit offset gives 64 CPEs per address, each with 1,024 - 16 = 1,008 ports in runs of 16 every 1,024 (RFC 7597, section 5.1). The tunnels themselves are in Running IPv6 and IPv4 together.

The fix that removes the sharing

"Deploying IPv6 is the only perennial way to ease pressure on the public IPv4 address pool without the need for address sharing mechanisms" (RFC 6269, section 1). Even the method that shrinks logs most disclaims the role: "Deterministic CGN should in no way be understood as making CGN a replacement for IPv6 service" (RFC 7422, section 4).

How to see it

On the home router, or a Linux host acting as one, list addresses in the shared space; to filters by prefix (ip-address(8)) and -4 selects IPv4 (ip(8)):

$ ip -4 address show to 100.64.0.0/10

Any output means the WAN side sits in shared space. If it differs from the address a server you control logs for the same connection, something translates between them; a WAN address in RFC 1918 or unadvertised public space can mean the same (RFC 6598, section 5.1). A traceroute without name lookups (-n, traceroute(8)) shows both layers:

$ traceroute -n example.com

illustrative output, timings omitted
 1  192.168.1.1     the home router, RFC 1918 space
 2  100.64.0.1      the provider side of the CGN link, shared space
 3  203.0.113.1     public hops from here on

ICMP, ping, and traceroute explains the messages. An operator captures both sides of the CGN, with the net primitive of pcap-filter(7) and -n of tcpdump(1), and matches them by protocol, ports and time: the source becomes a pool address and port, the destination stays. The Packet Capture Plan Builder helps choose the two points.

# tcpdump -n src net 100.64.0.0/10

A server keeps its half of the tuple with one setting: %a and %{remote}p in Apache's log format (Apache mod_log_config), smtpd_client_port_logging in Postfix (Postfix postconf(5)), and LogLevel VERBOSE for sshd (RFC 7768, appendix A; sshd_config(5)), with clocks on the Network Time Protocol () and logs in UTC.

# Apache httpd
LogFormat "%a %{remote}p %t" withport
CustomLog "logs/access_log" withport

# Postfix
smtpd_client_port_logging = yes

# OpenSSH sshd_config
LogLevel VERBOSE

On the CGN, records take three shapes: a line per mapping with RFC 6888's five fields, a line per block as in RFC 7768, and RFC 7422's configuration record: timestamp, inside prefix and mask, outside prefix and mask, D, M, A and reserved ports (RFC 7422, section 3).

illustrative, per mapping:  2026-10-19T14:02:11Z TCP 100.64.1.2:40000 -> 203.0.113.5:51234
illustrative, per block:    2026-10-19T14:02:11Z 100.64.1.2 -> 203.0.113.5 ports 2001-2300
RFC 7422, configuration:    [Wed Oct 11 14:32:52 2000]:198.51.100.0:28:192.0.2.0:32:2:5040:0:1-1023,5004,5060.

The SSRF URL classifier, a server-side request forgery () checker, labels http://100.72.0.1/ as carrier-grade NAT space at medium risk. The CIDR / Subnet Calculator, for Classless Inter-Domain Routing () blocks, shows 100.64.0.0/10 as 4,194,304 addresses ending at 100.127.255.255 but does not classify it. No tool computes a port block or a MAP PSID; the Python playground runs the arithmetic:

>>> (65536 - 1024) // 16
4032
>>> 1024 + 4032*1, 1024 + 4032*2 - 1
(5056, 9087)
>>> 33000 * 150 * 30 * 1_000_000 / 1e12
148.5
>>> 42.5e12 / 40.6e9
1046.7980295566501
>>> 2**(16 - 6) - 2**4
1008

What to remember

A CGN is a provider's NAT that shares one public IPv4 address among subscribers who do not control it; with the home NAT it makes NAT444, and 100.64.0.0/10 numbers the link between them.
RFC 6888 requires paired pooling, per-subscriber port limits and a mapping-control protocol, recommends endpoint-independent filtering, and inherits endpoint-independent mapping from RFC 4787.
RFC 7021 found browsing, mail and remote desktop working, and two-home gaming, BitTorrent seeding, SIP without a proxy, a home FTP server, 6to4 and Teredo failing.
An answerable request carries source address, source port and a timestamp from synchronised clocks; without the port, the answer is everyone on the address.
Per-connection logging costs about 4.95 MB per subscriber per day; port blocks divide that by the block size, and deterministic mapping replaces most lookups with arithmetic.
CGN-based designs keep per-session state in the provider; A+P designs pre-provision port sets and keep only rules or bindings with timestamps.