NAT / PAT Exhaustion
Model how many concurrent sessions your NAT/PAT can hold from public IPs and the ephemeral port range, how many users it supports and when it runs out. Simplified model (the real limit depends on the 5-tuple).
—
Port utilization
Rule of thumb: keep utilization below 80 % to leave headroom for peaks and bursts.
Breakdown
| Item | Value | Note |
|---|
How it is calculated · and why it is an upper bound
1. Ports per IP = end_port − start_port + 1.
The typical ephemeral range is 1024–65535 = 64,512 ports.
2. Capacity = public_IPs × ports_per_IP.
It is the ceiling of concurrent outbound sessions the PAT can translate at once.
3. Demand = users × sessions_per_user.
Sessions per public IP = demand / IPs.
4. Utilization = demand / capacity × 100.
Exhaustion happens when demand exceeds capacity. Users supported =
capacity / sessions_per_user. IPs needed =
ceil(demand / ports_per_IP).
Note: this is an upper bound. In practice the NAT distinguishes sessions by the 5-tuple (source and destination IP and port + protocol), so the same source port can be reused toward different destinations. Real exhaustion depends on how many sessions go to the same destination and on the device's translation table.
Runs locally in your browser · no sign-up · nothing leaves your browser
How it works
The calculator estimates how many concurrent sessions a NAT with overload (PAT, the classic NAT overload described in RFC 3022) can hold before running out of ports. The model is straightforward: ports per IP = last_port − first_port + 1 (the typical ephemeral range 1024–65535 yields 64,512), capacity = public_IPs × ports_per_IP, and demand = users × sessions_per_user. From that it reports the utilization percentage, supported users, required IPs and a verdict: comfortable, near the limit (above 80 %) or exhausted.
The result is a deliberately conservative upper bound: in practice the NAT distinguishes sessions by the full 5-tuple (source and destination IP and port plus protocol), so the same source port can be reused toward different destinations. That makes the tool ideal for sizing with margin: if the simple model already shows exhaustion, the real device will be under pressure even if the 5-tuple buys some slack.
Example: can one public IP handle 700 users?
- Ephemeral range 1024–65535:
65535 − 1024 + 1 = 64,512ports per IP; with 1 public IP the capacity is 64,512 sessions. - Demand:
700 users × 100 sessions = 70,000concurrent sessions. - Utilization:
70,000 / 64,512 ≈ 108.5 %→ exhaustion: 5,488 sessions short. - With this profile one IP supports
floor(64,512 / 100) = 645users; for 700 you need 2 public IPs or fewer sessions per user.