If we have a private network connected to the Internet with NAT, how can an attacker estimate the number of host computers in network using port scanning? For both possible modes, the attacker inside and outside the private network.

  • Why would port scanning help estimate this? Remember that established connections is identified by {local IP, local port, remote IP, remote port}, so a port scan by a third party will show all as closed - unless otherwise configured to forward or listen.
    – vidarlo
    Jan 16, 2021 at 19:41
  • @vidarlo For example, using TCP SYN scan can not help? We can send SYN packets to port 80 and the number of computers is equal to the number of computers that respond with SYN+ACK.
    – Meysam
    Jan 16, 2021 at 20:10
  • No, that's not how NAT or sockets work. A packet not matching the tuple will be silently discarded.
    – vidarlo
    Jan 16, 2021 at 20:26

1 Answer 1


From outside the a NAT network no direct port scanning of the internal network is possible. This is because packets from outside will only be forwarded to the internal network if there is some connection established from inside which matches the packet. See also Scan a computer behind NAT.

Scanning from inside is mostly trivial though: just enumerate all possible hosts in the local network and try the reaction to common ports. If there is some kind of response (i.e. SYN+ACK, RST, ...) then there is likely computer with this IP address.

And while direct scanning from outside is not possible, an outside attacker might actually be able to scan from inside. All what is needed for this is to lure somebody inside the internal network to a site controlled the attacker and then use the browser as the vehicle to scan the internal network. This is possible because the browser on an internal system has at the same time access to the internet and also internal network. See for example Exposing Intranets with reliable Browser-based Port scanning for more details.

Apart from active discovery there are also ways to passively detect the number of (active) devices behind a NAT. See for example Detecting NAT Devices using sFlow and other research.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .