# Bound carrier-grade NAT resources, logging, and port allocation > Use RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs) to review this narrow operational decision without extending the source beyond its stated scope. - Canonical URL: https://update.dsesecurity.com/updates/bound-carrier-grade-nat-resources-logging-and-port-allocation/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-27T12:16:39+00:00 - Modified: 2026-08-27T12:36:16+00:00 - Last reviewed by DSE: 2026-08-26 - Resource type: Checklist - DSE priority: Advisory - Topics: IT, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Use RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs) to review this narrow operational decision without extending the source beyond its stated scope. ## Potentially affected Teams, systems, services, or facilities within the stated scope of RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs) ## DSE recommendation Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards. ## Article Treat this document as a focused evidence review: Bound carrier-grade NAT resources, logging, and port allocation. Only the official source and traced locations below supply facts. Confirm applicability before acting. ## Source fact: The official [RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs)](https://www.rfc-editor.org/rfc/rfc6888.html) from RFC Editor / Internet Engineering Task Force supports the following bounded statements: - A carrier-grade NAT must support administrator-configurable per-subscriber external-port limits and should support configurable limits on mapping and subscriber state memory. The research record locates this support at Section 3 (Requirements for CGNs), requirements 4 and 5. - Mapping logs can identify a subscriber from protocol, subscriber identifier, translated address and port, and time; destination addresses and ports should not be logged without an administrative need. The research record locates this support at Section 4 (Logging), requirement 12. - A port-allocation scheme should balance three competing goals: high port utilization, low log volume, and port numbers that attackers cannot easily guess. The research record locates this support at Section 5 (Port Allocation Scheme), requirements 13-15. Keep the evidence boundary at these traced claims. They support a review of address plans, interfaces, routes, peers, protocol roles, timers, middleboxes, and intended failure domains; they do not support conclusions outside the source’s stated conditions. ## What the source does not establish This RFC evidence supports only the named network-protocol decision; it does not select vendor settings, topology, capacity, or an acceptable failure mode. Do not read the source as proof of implementation or permission to change production. Its guidance remains conditional on DNS, Active Directory authentication, PKI, time, routing policy, transport reachability, and monitoring and the environment’s recorded constraints. ## Applicability questions - For source statement 1 at Section 3 (Requirements for CGNs), requirements 4 and 5, which observable configuration, record, or test can confirm applicability here? - For source statement 2 at Section 4 (Logging), requirement 12, which observable configuration, record, or test can confirm applicability here? - For source statement 3 at Section 5 (Port Allocation Scheme), requirements 13-15, which observable configuration, record, or test can confirm applicability here? - Within address plans, interfaces, routes, peers, protocol roles, timers, middleboxes, and intended failure domains, which versions, roles, and configuration states define the review population? - Could DNS, Active Directory authentication, PKI, time, routing policy, transport reachability, and monitoring invalidate the test, hide a failure, or change applicability? - Who owns the decision, and which observation requires stopping, escalation, or rollback? ## DSE recommendation: DSE recommends using the cited source as the evidence anchor for this decision. Anchor the review in the cited section and keep observation separate from interpretation. Record the source location, examined part of address plans, interfaces, routes, peers, protocol roles, timers, middleboxes, and intended failure domains, observed and expected states, owner, and reason for deviation. Do not move from citation to production in one step. Pilot the decision where practical, observe agreed signals, retain a reversal point, and verify DNS, Active Directory authentication, PKI, time, routing policy, transport reachability, and monitoring. Handle credentials, keys, recovery data, and personal information through approved secure channels. ## Verification and evidence Keep the source locations Section 3 (Requirements for CGNs), requirements 4 and 5; Section 4 (Logging), requirement 12; Section 5 (Port Allocation Scheme), requirements 13-15 adjacent to the sanitized artifacts used for comparison. Prefer configuration snapshots, route or neighbor state, packet captures, counters, topology records, and controlled failover results, with enough identity and timing data for an independent recheck. Retain the starting state, authorization, execution record, outcome, deviation, and final state as one review package. Move disruptive checks to an approved test path. Reopen the decision when versions, design, dependencies, ownership, or official guidance changes. ## Official references - [RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs)](https://www.rfc-editor.org/rfc/rfc6888.html) — RFC Editor / Internet Engineering Task Force ## Primary reference - Name: RFC 6888 — Common Requirements for Carrier-Grade NATs (CGNs) - Authority: www.rfc-editor.org - URL: https://www.rfc-editor.org/rfc/rfc6888.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Bound carrier-grade NAT resources, logging, and port allocation,” DSE Security, https://update.dsesecurity.com/updates/bound-carrier-grade-nat-resources-logging-and-port-allocation/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.