Lockless stateful network address translation

A method to be performed by a processor, comprising:

• receiving a packet;
• getting an original tuple from the packet;
• when no state information for a packet flow of the packet exists in a state table, selecting a new network address as a new source address for the packet, getting a reverse tuple for a reverse direction, selecting a port for the packet from an entry in a mapping table by applying a Toeplitz hash function using the reverse tuple, entries in the mapping table including pre-computed multi-bit hash value/port, and saving the new network address and selected port;
• translating the packet's network address and port;
• and
• transmitting the packet
• wherein when no state information for the packet flow exists in the state table, setting a destination port in the reverse tuple to zero, computing a hash value of the reverse tuple, performing an exclusive-OR (XOR) operation on the hash value of the reverse tuple and a hash value of the original tuple, masking a plurality of the least significant bits (LSBs) of the XOR result to select a port for the packet from an entry in the mapping table based on the masked value, saving the new network address and selected port into a state associated with a connection of the packet flow, and inserting information describing the packet flow into the state table.

At least one non-transitory tangible machine-readable medium comprising a plurality of instructions that in response to being executed by a processor cause the processor to:

• receive a packet;
• get an original tuple from the packet;
• when no state information for a packet flow of the packet exists in a state table, select a new network address as a new source address for the packet, get a reverse tuple for a reverse direction, select a port for the packet from an entry in a mapping table by applying a Toeplitz hash function using the reverse tuple, entries in the mapping table including pre-computed multi-bit hash value/port pairs, and save the new network address and selected port;
• translate the packet's network address and port;
• and
• transmit the packet;
• wherein when no state information for the packet flow exists in the state table, execution of instructions cause the processor to set a destination port in the reverse tuple to zero, compute a hash value of the reverse tuple, perform an exclusive-OR (XOR) operation on the hash value of the reverse tuple and a hash value of the original tuple, mask a plurality of the least significant bits (LSBs) of the XOR result to select a port for the packet from an entry in the mapping table based on the masked value, save the new network address and selected port into a state associated with a connection of the packet flow, and insert information describing the packet flow into the state table.