# Exercise 2 — NAT Translation Tables and Their Limits

## Scenario

You're explaining to a junior teammate why they can't just "connect directly" to their home desktop from work without extra setup, and separately, why an ARP-based attack is possible on the office Wi-Fi but wouldn't work against a random server on the internet. This exercise makes both explanations precise.

## Deliverables

1. **Build a translation table.** Three private hosts behind one router (public IP `198.51.100.20`) each open one outbound connection at the same time:
   - `10.0.0.5:53000` → `93.184.216.34:443`
   - `10.0.0.6:53000` → `93.184.216.34:443` (note: same source port as the host above, different private host)
   - `10.0.0.5:53500` → `172.217.0.4:443`

   Write out the router's NAT translation table after all three connections are established, choosing distinct translated public ports where needed, and explain specifically why `10.0.0.5:53000` and `10.0.0.6:53000` cannot both be translated to the same public port even though their private-side ports are identical.

2. **Inbound packet, no matching row.** A packet arrives at the router addressed to `198.51.100.20:9999`, and no row in the translation table matches port 9999. Walk through, step by step, exactly what the router does with it and why — tie your answer directly to the "outbound-first" mechanism from the theory file, not a general "NAT blocks it" statement.

3. **Port forwarding, precisely.** The teammate wants to run a personal Minecraft server on `10.0.0.5:25565` and connect to it from outside their home network. Explain exactly what a port-forwarding rule must configure in the router's translation table to make this work, and why this specific host now has a different security exposure than the other private hosts on the same network that don't have a forwarded port.

4. **ARP attack scope.** Explain precisely why an ARP-spoofing attack could let a malicious laptop on the office Wi-Fi intercept traffic between two of your coworkers' laptops, but that same attacker sitting at home could NOT use ARP spoofing to intercept traffic between your coworkers and a server like `93.184.216.34` on the public internet. Reference the theory file's explanation of ARP's broadcast-domain scope directly.

## Notes

- Deliverable 1 is the core of this exercise — be exact about which fields in the table differ and why a collision is avoided.