Editing Network address translation (section)

=== Fragmentation and checksums ===
Pure NAT, operating on IP alone, may or may not correctly parse protocols with payloads containing information about IP, such as [[ICMP]]. This depends on whether the payload is interpreted by a host on the ''inside'' or ''outside'' of the translation. Basic protocols such as [[Transmission Control Protocol|TCP]] and [[User Datagram Protocol|UDP]] cannot function properly unless NAT takes action beyond the network layer.

IP packets have a checksum in each packet header, which provides error detection only for the header. IP datagrams may become fragmented and it is necessary for a NAT to reassemble these fragments to allow correct recalculation of higher-level checksums and correct tracking of which packets belong to which connection.

TCP and UDP have a checksum that covers all the data they carry, as well as the TCP or UDP header, plus a ''pseudo-header'' that contains the source and destination IP addresses of the packet carrying the TCP or UDP header. For an originating NAT to pass TCP or UDP successfully, it must recompute the TCP or UDP header checksum based on the translated IP addresses, not the original ones, and put that checksum into the TCP or UDP header of the first packet of the fragmented set of packets.

Alternatively, the originating host may perform [[path MTU Discovery]] to determine the packet size that can be transmitted without fragmentation and then set the ''don't fragment'' (DF) bit in the appropriate packet header field.  This is only a one-way solution, because the responding host can send packets of any size, which may be fragmented before reaching the NAT.