Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The standard defense against the Kaminsky attack is to use source port randomization for all DNS requests.

Does NAT break the security benefits of source port randomization?

In more detail, consider a client that sits behind a NAT. Suppose the client uses source port randomization for all DNS requests, and issues a request. When the request traverses the NAT, the NAT may translate the source port number to a new source port from within the NAT's pool of local port numbers.

I worry that, if the NAT uses a predictable port assignment strategy, this may derandomize the source port on the packet -- leaving the client open to a Kaminsky attack. Does this happen in practice? Do NATs translate the source port on DNS requests? Do they use predictable source ports? If this is a problem for some NATs, does anyone know how prevalent the problem is? Do NATs these days take any measures to avoid screwing up source port randomization? Is there anything one should do, when configuring a NAT, to ensure the NAT doesn't make you more vulnerable to Kaminsky attacks?

share|improve this question
I shan't post an answer until I've done some research, but I just tested my router, and it doesn't change the port. It's just a crappy home one, so I certainly can't comment on some of the larger corporate NAT routers. – Polynomial Oct 5 '12 at 7:29
up vote 4 down vote accepted

Obviously the implications are going to be implementation-dependent. The NAT device is free to choose any source port desired, and some implementations may have historically used sequential port numbering. But with newer hardware this is becomming increasingly unlikely.

Specifically, newer routers prefer to use the client computer's original source port (particularly for UDP) specifically to allow NAT traversal using a technique now called UDP hole punching.

At one point this was considered a sought-after feature for gaming, Skype, etc., but now it's pretty much expected.

Also, bear in mind the in most instances, the router sets itself up as the preferred DNS server for its network, then runs a forwarding resolver locally on the device. This would mean that port randomization on the client computer would be irrelevent; instead the randomization would need to be a feature of the router's DNS resolver.

share|improve this answer

It depends on the device doing the NAT. Most sophisticated firewalls have fingerprint scrambling features that can be enabled, for example Checkpoint has had those features since NG I believe, so a good 10 years. A basic router will not do fingerprint scrambling, it will just use the source port in the TCP packet. Some few network devices will actually map source ports to sequential numbers, but that's very rare.

So the answer to your question is almost always a qualified no, as long as your OS is using source port randomization. If your OS is using predictable source ports and you have a NAT device that doesn't randomize them for you then there's no protection against predictive attacks. If your NAT device maps to sequential source ports then it tells an attacker more about your network device than the systems inside it.

share|improve this answer

Even if the NAT device randomises the source ports it may still expose to DNS cache poisoning attacks, see here a research on security of patched NAT and DNS devices:

share|improve this answer
Welcome to Stack Echange. This is a questions and answers site, so we like to have answers with real content, not just links. I've skimmed the article you cite and it does look relevant, but could you summarize the gist of the attacks in your answers? Thanks. – Gilles Feb 1 '13 at 14:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.