A NAT table is the gateway’s state database for network address translation. It records live mappings between internal IP addresses and ports and the external addresses or ports used on the public side of the connection. In effect, it is the bookkeeping that tells the router which packets belong to which active session.
This state is security-relevant because many services depend on it staying accurate. If entries are overwritten, expired too early, or flooded with too many mappings, traffic can be misrouted, dropped, or redirected. Attackers may try to manipulate NAT state to interfere with established TCP sessions, expose forwarded services, or create denial-of-service pressure by exhausting the table. Defenders monitor NAT table growth, unusual port mappings, and session-state changes to spot abuse and keep translation behavior consistent.