NAT from the outside-in

[kenjordan]

I would like to know if there is anyway to tell how many devices are are being translated by a NAT device that I have no administrative control over from the outside. For example, if I am an ISP and want to know if a business or residential customer is re-routing the connection multiple times.

My impression is that if you sniff the line you can't tell because one inside device may be using multiple applications with different port numbers. I have been told that there may be a way to check with MAC addresses but I didn't think a NAT or firewall kept any record of MAC addresses.

Thanks for any info,

Ken

[jan.klepal]

There is no way how to check how many computers are behind NAT device.

To check what MAC addresses are used on the line between your and customer's router simply type "show ip arp". But there will be only MAC addresses which are on segments directly connected to your router.

By sniffing traffic on the line you can only guess how many computers are behind NAT device. For example count simulateous connections from NAT device to internet with destination port 80. Unfortunetaly it is very inaccurate...